CVE-2021-36899: 
WordPress vulnerability analysis and mitigation

CVE-2021-36899 is an Authenticated Reflected Cross-Site Scripting (XSS) vulnerability affecting Gabe Livan's Asset CleanUp: Page Speed Booster WordPress plugin versions 1.3.8.4 and below. The vulnerability was discovered and reported by Nguyen Van Khanh, with public disclosure on September 28, 2022 (Patchstack).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.8 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

This vulnerability could allow a malicious actor with administrator privileges to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site (Patchstack).

The vulnerability requires administrator or higher privileges to exploit, making it a low-risk issue. The attack complexity is low, but requires user interaction and high privileges for successful exploitation (Patchstack).

The vulnerability has been fixed in version 1.3.8.5 of the Asset CleanUp: Page Speed Booster plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).