Asset CleanUp: Page Speed Booster vulnerabilities

The WordPress plugin Asset CleanUp: Page Speed Booster in versions up to 1.4.0.5 contains an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker can trick a victim into performing unwanted actions.

The Asset CleanUp: Page Speed Booster plugin for WordPress (versions up to and including 1.4.0.5) is vulnerable to stored cross-site scripting via comment content due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute when a user visits the injected page. This is only exploitable when combine_loaded_css is enabled.

The Asset CleanUp: Page Speed Booster plugin (wp-asset-clean-up) by Gabe Livan (through 1.4.0.3) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.