Asset CleanUp < 1.3.8.5 - Reflected Cross-Site Scripting

The plugin does not escape the wpacuselectedsubtabarea parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue...

Asset CleanUp < 1.3.8.5 - Reflected Cross-Site Scripting via AJAX Action

The plugin does not sanitise and escape POSted parameters sent to the wpassetcleanupfetchactivepluginsicons AJAX action available to admin users, leading to a Reflected Cross-Site Scripting issue alert/XSS/" / var form1 = document.getElementById'hack'; form1.submit;...

Asset CleanUp: Page Speed Booster < 1.3.6.7 - CSRF & XSS

Antony Garand of Sucuri discovered that multiple WordPress plugins were vulnerable to Cross-Site Scripting XSS within the admin panel, which could be exploited by using s Cross-Site Request Forgery CSRF attack...

WordPress Asset CleanUp: Page Speed Booster plugin <= 1.3.6.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability found by Antony Garand Sucuri in WordPress Asset CleanUp: Page Speed Booster plugin versions = 1.3.6.6. Solution Update the WordPress Asset CleanUp: Page Speed Booster plugin to the latest available version at least 1.3.6.7...