Stored XSS in Asset CleanUp: Page Speed Booster WordPress Plugin

The Asset CleanUp: Page Speed Booster plugin for WordPress, specifically in versions 1.4.0.5 and earlier, contains a critical stored cross-site scripting (XSS) vulnerability, tracked as CVE-2026-13354. The vulnerability exists due to insufficient sanitization and output escaping when processing comment content. An unauthenticated attacker can leverage this flaw to inject arbitrary malicious web scripts into pages. These scripts are subsequently executed in the browser of any user who accesses the compromised page, potentially leading to unauthorized actions, session hijacking, or redirection. Successful exploitation is contingent on the site having the 'combine_loaded_css' configuration setting enabled. Given the nature of the vulnerability, it presents a high risk for sites that allow user comments and utilize this specific performance-enhancing plugin configuration.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of victim browsers. This can lead to the theft of session cookies, administrative account takeover, or redirection of users to malicious third-party websites. The vulnerability impacts all WordPress installations using the vulnerable plugin version with the specific CSS combination feature active.

Recommendation

Prioritize the following actions to mitigate risk associated with CVE-2026-13354:

• Update the 'Asset CleanUp: Page Speed Booster' plugin to a version released after 1.4.0.5 immediately.
• Review WordPress site configurations and temporarily disable the 'combine_loaded_css' setting if immediate patching is not possible.
• Perform an audit of existing comments and site content for embedded script tags or suspicious attributes if the site has been exposed to the internet.