CVE-2021-36899

The CVE-2021-36899 entry concerns the WordPress Asset CleanUp: Page Speed Booster plugin, versions

CVE-2021-24937

The CVE-2021-24937 entry concerns the WordPress plugin Asset CleanUp: Page Speed Booster prior to version 1.3.8.5. The root cause is improper escaping of the wpacu_selected_sub_tab_area parameter in admin-page output, enabling a Reflected Cross-Site Scripting (XSS) vulnerability. Multiple sources...

CVE-2021-24983

The CVE describes a Reflected Cross-Site Scripting vulnerability in the Asset CleanUp: Page Speed Booster WordPress plugin, affecting versions prior to 1.3.8.5. The issue arises because POSTed parameters sent to the AJAX action wpassetcleanup_fetch_active_plugins_icons (accessible to admin users)...