What is the CVSS score of CVE-2026-13354?

CVE-2026-13354 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-13354?

Within 24 hours, inventory every WordPress site running Asset CleanUp: Page Speed Booster and confirm whether the version is at or below 1.4.0.5; for each affected site, check whether the combine_loaded_css CSS-combining optimization is enabled, since this is the precondition for exploitation - where it is enabled, disable that optimization immediately and, if the site does not require public commenting, temporarily disable or restrict comment submission as a second gate. Within 7 days, subscribe to the plugin vendor's advisory channel and WordPress security feeds to obtain the fixed version as soon as it ships, test and deploy it across all affected sites, and in the interim deploy a web application firewall rule or content security policy that blocks inline script execution in comment-rendered pages and sanitize or remove untrusted comment content already stored in the database. Within 30 days, complete remediation across the full estate, remove the plugin entirely on any site where the optimization is not operationally required, and fold third-party plugin review, version currency checks, and comment-input sanitization into routine patch governance so unpatched components with non-default feature dependencies are identified before they are exploited.

Asset CleanUp CVE-2026-13354

EUVD-2026-83469 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-09-19 Wordfence

GHSA-7gwr-8m73-rgp7

WordPress XSS Wordpress Plugin Asset Cleanup

7.2

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Submit comment with script payload
Delivery

Plugin stores unsanitized content in combined CSS/JS path
Exploit

Victim loads affected page
Execution

Script executes in victim browser context
Impact

Session/action abuse in victim's browser

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the target WordPress site run Asset CleanUp: Page Speed Booster at or below version 1.4.0.5 AND have the 'combine_loaded_css' CSS-combining optimization feature explicitly enabled - this is a non-default configuration that gates the entire vulnerability. The attack vector is the site's comment submission (Comment Content), which is available to unauthenticated visitors (PR:N) on sites that permit comments. Realistic risk is limited by: (1) the combine_loaded_css setting being off by default, (2) the requirement that comments be enabled/accepted on the target site, and (3) the payload only firing when a user subsequently loads the affected/injected page. Impact is client-side script execution in the victim's browser (C:L/I:L), not server compromise.
Impact	Signals point to a real but conditionally-gated web risk rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 HIGH) describes network-reachable, unauthenticated stored XSS with a scope change, which is why the score lands in HIGH territory despite only Low confidentiality and Low integrity impact. However, the description itself narrows this sharply: exploitation is 'only exploitable on instances where combine_loaded_css has been enabled,' a non-default CSS-combining optimization setting - this materially undercuts the AC:L rating and means the true attack complexity is higher than the vector suggests. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a legitimate patch-soon issue for affected WordPress sites (unauthenticated stored XSS is attractive to opportunistic actors), but the config precondition makes it targeted/conditional rather than broadly wormable. Note the conflict to verify: CVSS marks UI:N while stored XSS normally requires a victim to view the injected page - Wordfence appears to treat auto-execution on page access as UI:N.
Exploit ScenarioDerived	An unauthenticated attacker submits a blog comment containing a malicious script payload to a WordPress site running Asset CleanUp with the combine_loaded_css optimization enabled. Because the plugin insufficiently sanitizes and escapes comment-derived content when combining/optimizing assets, the script is stored and later served, executing in the browser of any user who accesses the affected page. No public exploit code was identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 19, 2026

Stored cross-site scripting in the WordPress plugin Asset CleanUp: Page Speed Booster (all versions through 1.4.0.5) lets unauthenticated visitors inject arbitrary script through comment content, which then executes in the browser of any user who subsequently loads the affected page. The flaw is gated by a non-default configuration: the combine_loaded_css CSS-combining optimization must be explicitly enabled, and the site must accept comments, so most default installs are not exposed; the independent assessment rates exploitation complexity as High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) with impact confined to client-side script execution rather than server compromise. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS or KEV signal is present in the provided intelligence.

RemediationAI

Apply the vendor fix by updating Asset CleanUp: Page Speed Booster beyond the affected 1.4.0.5 release once the patched version is available - the referenced changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3699024%40wp-asset-clean-up&new=3699024%40wp-asset-clean-up indicates an upstream code fix exists, but a released patched version number is not independently confirmed from the supplied data, so verify the installed version against the vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4cc8ec2b-f203-4c7c-8720-043f8634a447?source=cve rather than assuming a version. Until then, disable the plugin's combine_loaded_css CSS-combining option in the Asset CleanUp settings; the trade-off is loss of that page-speed optimization, but it removes the code path that emits unescaped content. If comments are not essential, disable or restrict comment submission and require moderation, accepting the loss of visitor engagement, and consider filtering comment input with a WAF or security plugin rule that blocks script markup, recognizing that such signatures can produce false positives on legitimate comment text. After remediation, confirm the combine_loaded_css setting and search existing comment data for injected script payloads that may have been stored before the patch was applied.

Affected VersionsENISA

Asset CleanUp: Page Speed Booster 0 ≤1.4.0.5

Affected Packages

euvd asset_cleanup_page_speed_booster no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This is a classic CWE-79 improper neutralization of input during web page generation (cross-site scripting), specifically the stored/persistent variant. Comment content submitted to WordPress is retained in the database and later rendered into pages; Asset CleanUp's CSS and JS optimization routines (referenced source lines in classes/OptimiseAssets/OptimizeCss.php around line 579 and OptimizeJs.php around line 824 at tags 1.4.0.3 and 1.4.0.4) fail to sanitize input and escape output when the combine_loaded_css feature merges loaded stylesheets into the page, allowing attacker-controlled markup to be emitted into the HTML that browsers execute. Authentication is not required for the injection (PR:N), consistent with anonymous comment submission, and the scope is changed (S:C) because the injected script runs in the security context of the vulnerable site's pages rather than the attacker's own origin. The affected component is tracked by CPE cpe:2.3:a:gabelivan:asset_cleanup:_page_speed_booster:* (vendor gabelivan), and the gating condition - combine_loaded_css being enabled - explains why the assessed attack complexity is High even though the vulnerability class itself is straightforward.

Know when Asset Cleanup gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI 5.4 MEDIUM

Unauthenticated remote comment injection (PR:N) with browser-context scope change (S:C) and low C/I impact, but AC:H because it only works when the non-default combine_loaded_css setting is enabled.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

DescriptionCVE.org

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable on instances where combine_loaded_css has been enabled.

Executive ViewAI

Why It Matters

The WordPress plugin Asset CleanUp: Page Speed Booster - deployed across all versions through 1.4.0.5 - carries a stored cross-site scripting flaw that lets unauthenticated visitors plant malicious script in comment content, which then executes in the browsers of anyone who later views the affected page, including logged-in administrators. Exposure is not universal: the flaw only activates on sites that have enabled the non-default CSS-combining optimization and that accept comments, so leadership should prioritize discovery of which properties meet both conditions. With no vendor patch available and no public exploit identified, the near-term risk is hijacked administrator sessions and content tampering rather than server compromise, but an unpatched, internet-facing web presence warrants prompt action.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: disable the combine_loaded_css CSS-combining optimization (the non-default setting that gates the flaw), disable or restrict public commenting where not required, purge or sanitize existing untrusted comment content, and enforce a WAF rule or content security policy blocking inline script execution on affected pages.

Threat Intelligence Overview

EPSS Score

0.2%

Top 84% exploitable

Prevalence

Medium

popular WordPress page-speed/asset-optimization plugin, common but not universal

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.