https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-36899.htmlhttps://patchthecve.com/cve/CVE-2021-36899.htmlWed, 17 Jun 2026 03:59:36 +0000MEDIUM 4.8: Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Gabe Livan's Asset CleanUp: Page Speed Booster plugin <= 1.3.8.4 at WordPress.https://patchthecve.com/cve/CVE-2021-24983.htmlhttps://patchthecve.com/cve/CVE-2021-24983.htmlWed, 17 Jun 2026 03:41:15 +0000MEDIUM 6.1: The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users), leading to a Reflected Cross-Site Scripting issuehttps://patchthecve.com/cve/CVE-2021-24937.htmlhttps://patchthecve.com/cve/CVE-2021-24937.htmlWed, 17 Jun 2026 03:41:09 +0000MEDIUM 6.1: The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacu_selected_sub_tab_area parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue