CVE-2026-13354: Asset CleanUp WordPress Plugin XSS Flaw

CVE-2026-13354 Overview

CVE-2026-13354 is a Stored Cross-Site Scripting (XSS) vulnerability in the Asset CleanUp: Page Speed Booster plugin for WordPress. The flaw affects all versions up to and including 1.4.0.5 and stems from insufficient input sanitization and output escaping in comment content handling. Unauthenticated attackers can inject arbitrary web scripts that execute when users load an affected page. Exploitation requires the combine_loaded_css option to be enabled on the target instance. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can persist JavaScript in WordPress pages, enabling session theft, redirection, and administrative account compromise when authenticated users view injected content.

Affected Products

Asset CleanUp: Page Speed Booster plugin for WordPress
All versions up to and including 1.4.0.5
Instances with combine_loaded_css configuration enabled

Discovery Timeline

2026-09-19 - CVE-2026-13354 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-13354

Vulnerability Analysis

The vulnerability resides in the CSS and JavaScript optimization routines of the Asset CleanUp plugin. When combine_loaded_css is enabled, the plugin processes comment content and incorporates it into optimized asset output without adequate sanitization. Attacker-controlled comment data reaches page rendering paths without HTML entity encoding, allowing arbitrary <script> payloads to execute in the victim's browser.

Stored XSS in a WordPress optimization plugin has an amplified blast radius. Cached and combined assets are served to every visitor, so a single injected payload propagates to all users viewing the affected page. Authenticated administrators visiting an affected page may have session cookies harvested or actions performed on their behalf.

Root Cause

The root cause is missing input sanitization on comment content and missing output escaping before writing to combined CSS or JavaScript resources. Relevant code paths are visible in classes/OptimiseAssets/OptimizeCss.php at line 579 and classes/OptimiseAssets/OptimizeJs.php at line 824 in tagged releases 1.4.0.3 and 1.4.0.4. See the WordPress Optimize CSS Code and WordPress Optimize JS Code references.

Attack Vector

The attack is network-based and requires no authentication or user interaction beyond a victim loading an affected page. An unauthenticated attacker submits a comment containing an XSS payload on a target site running a vulnerable version with combine_loaded_css enabled. The payload is stored, incorporated into optimized asset output, and executed in the browser context of every subsequent visitor to the affected page.

See the Wordfence Vulnerability Report and the CleanTalk CVE-2026-13354 Overview for additional technical context. No verified public exploit code is available at this time.

Detection Methods for CVE-2026-13354

Indicators of Compromise

Comment records containing <script>, onerror=, onload=, or javascript: sequences in the wp_comments table
Combined CSS or JavaScript output files under wp-content/cache/asset-cleanup/ containing HTML markup or script tags outside expected asset syntax
Unexpected outbound requests from user browsers to attacker-controlled domains after loading affected pages
Administrator sessions initiated from unfamiliar IP addresses following visits to comment-heavy pages

Detection Strategies

Query the WordPress database for comments containing HTML tags or JavaScript event handlers submitted while a vulnerable plugin version was active
Inspect generated cache files produced by the Asset CleanUp optimization pipeline for injected script content
Monitor web server access logs for POST requests to wp-comments-post.php containing script-like payloads

Monitoring Recommendations

Alert on Content Security Policy violation reports from WordPress front-end pages
Track new administrator account creation and privilege changes correlated with comment activity
Log and review changes to Asset CleanUp configuration, particularly toggles of the combine_loaded_css setting

How to Mitigate CVE-2026-13354

Immediate Actions Required

Update the Asset CleanUp: Page Speed Booster plugin to a version newer than 1.4.0.5 as soon as a patched release is available
Disable the combine_loaded_css option to eliminate the exploitable code path until patched
Purge all Asset CleanUp cached assets to remove any previously injected payloads
Audit wp_comments for HTML or script content and remove or sanitize malicious entries

Patch Information

Review the WordPress Change Set Log for the code changes associated with the fix. Administrators should confirm they are running a version that includes proper sanitization and output escaping in OptimizeCss.php and OptimizeJs.php.

Workarounds

Disable the combine_loaded_css feature in Asset CleanUp settings to break the exploitation prerequisite
Deploy a Web Application Firewall (WAF) rule blocking script tags and JavaScript event handlers in comment submissions
Require comment moderation for all unauthenticated submissions to prevent immediate persistence of malicious content
Apply a restrictive Content Security Policy that disallows inline scripts on public-facing pages

bash

# Configuration example: disable vulnerable option via WP-CLI
wp option patch update wpassetcleanup_settings combine_loaded_css false
wp cache flush
wp asset-cleanup cache clear