Asset CleanUp: Page Speed Booster

Asset CleanUp (affected: <= 1.4.0.5). An Administrator or higher can supply page_url to make server-origin requests to arbitrary destinations, including internal services. The SSRF path is reachable only when an administrator has configured dom_get_type as wp_remote_post. The endpoint and response visibility are unspecified.

Unauthenticated comment content can become stored script through insufficient sanitization and output escaping when combine_loaded_css is enabled. A user must view affected output for browser execution. The export does not disclose the vulnerable rendering function, precise injected field or whether comment approval is required; it does not establish a moderation bypass. Authoritative affected range: <= 1.4.0.5. No fixed release is confirmed in this review.

Asset CleanUp: Page Speed Booster through 1.4.0.5 is affected by CSRF: an attacker needs no account but must induce victim interaction so a request is sent in the victim's browser context. The export does not name the endpoint, action, parameters, required victim role or operation performed. Its CNA vector reports limited confidentiality, integrity and availability impact with a changed scope; it does not establish a particular data disclosure, setting change or destructive action. The affected-version data marks 1.4.0.6 unaffected.

Asset CleanUp: Page Speed Booster is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.4.0.3.

Asset CleanUp: Page Speed Booster is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.

Asset CleanUp: Page Speed Booster is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Asset CleanUp: Page Speed Booster is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.