CVE-2026-13354

Name of the Vulnerable Software and Affected Versions Asset CleanUp: Page Speed Booster versions prior to 1.4.0.6

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via comment content. This enables the injection of arbitrary web scripts into pages, which execute when a user accesses the affected page. This issue is only exploitable when the combine loaded css setting is enabled.

Recommendations Update Asset CleanUp: Page Speed Booster to version 1.4.0.6 or later. Disable the combine loaded css setting as a temporary mitigation measure.