Wp Asset Clean Up Vulnerabilities

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.4.0.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.4.0.3

Fixed in:

1.4.0.4

Disclosed:

Mar 7, 2026

CVE-2026-45212 on NVD →

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.9.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web appli...

CVSS:

5.5

Affected:

up to 1.3.9.8

Fixed in:

1.3.9.9

Disclosed:

Nov 27, 2024

CVE-2024-53738 on NVD →

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.3.9.3

Fixed in:

1.3.9.4

Disclosed:

Aug 16, 2024

CVE-2024-43314 on NVD →

The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...

CVSS:

6.1

Affected:

up to 1.3.5.4

Fixed in:

1.3.5.5

Disclosed:

Jul 18, 2023

CVE-2023-33999 on NVD →

The Asset CleanUp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully...

CVSS:

6.1

Affected:

up to 1.3.8.4

Fixed in:

1.3.8.5

Disclosed:

Sep 28, 2022

CVE-2021-36899 on NVD →

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users), leading to a Reflected Cross-Site Scripting issue

CVSS:

6.1

Affected:

up to 1.3.8.5

Fixed in:

1.3.8.5

Disclosed:

Jan 3, 2022

CVE-2021-24983 on NVD →

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacu_selected_sub_tab_area parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue

CVSS:

6.1

Affected:

up to 1.3.8.4

Fixed in:

1.3.8.5

Disclosed:

Jan 3, 2022

CVE-2021-24937 on NVD →

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the tab parameter in versions up to, and including 1.3.6.6 due to insufficient input sanitization and output escaping on add_query_arg and remove_query_arg. This makes it possible for unauthenticated attackers...

CVSS:

6.1

Affected:

up to 1.3.6.7

Fixed in:

1.3.6.7

Disclosed:

Apr 20, 2015