The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.19.07.14. This is due to missing authorization checks on the aj_steps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it possible for authenticated attackers with subscriber level permissions and above to inject malicious web scripts into a page that execute whenever a user accesses that page.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Async Javascript Plugin | — | Update async-javascript plugin to version 2.20.02.27, or a newer patched version | Oct 21, 2025 | Feb 27, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub