CVE-2026-13354 describes a stored cross-site scripting vulnerability in the Asset CleanUp: Page Speed Booster plugin for WordPress. The flaw exists in the handling of comment content where input is not properly sanitized or escaped before being rendered on web pages. This allows unauthenticated attackers to inject arbitrary scripts that execute in the context of users visiting the affected pages. The vulnerability affects all plugin versions from 0 up to and including 1.4.0.5 and requires the combine_loaded_css feature to be enabled for exploitation.

Successful exploitation can lead to execution of arbitrary scripts in the browsers of users visiting the injected pages, potentially resulting in theft of sensitive information, session hijacking, or other malicious actions. The vulnerability is exploitable remotely without authentication, increasing its risk. However, it requires a specific plugin feature (combine_loaded_css) to be enabled, limiting the attack surface.

No official patch or fix is currently documented for this vulnerability. Users should verify if the combine_loaded_css feature is enabled and consider disabling it as a temporary mitigation. Monitor the vendor's advisory channels for updates and patches. Avoid allowing untrusted users to submit comments until a fix is available.