Executive brief
Asset CleanUp is a WordPress plugin that optimizes page performance by managing CSS and JavaScript loading. The plugin is vulnerable to stored cross-site scripting through comment content, allowing attackers to inject malicious scripts that execute when users view pages with comments. This could lead to session hijacking, credential theft, or malware distribution on vulnerable WordPress sites.
Technical details
The plugin fails to properly sanitize and escape user input in comment content when the combine_loaded_css feature is enabled, allowing unauthenticated attackers to store arbitrary JavaScript in the database. When users access pages containing injected comments, the malicious scripts execute in their browser context with the privileges of the affected user. Exploitation requires the combine_loaded_css setting to be enabled on the target site.
Affected products
- Wp Asset Clean Up Asset CleanUp: Page Speed Booster up to and including 1.4.0.5
Timeline
- 2026-09-19: disclosed