Asynchronous Javascript
Asynchronous Javascript has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Asynchronous Javascript has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.
All of these findings were reported by Skalucy. Asynchronous Javascript is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 3.5.2.
CVE-2025-68846Asynchronous Javascript <= 1.3.5 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
Asynchronous Javascript
Author
Paris Holley
This plugin is meant to be a drop-in to your wordpress installation with no additional configuration. The goals/features of this plugin are: Load javascript files in an asynchronous manner to improve time to DomReady/OnLoad Use existing wordpress APIs for backwards compatability and prevent coupling to this plugin Leverage dependency model wordpress provides for assets to improve loading performance Please submit bugs or contributions to the github location and not here on wordpress’ system: https://github.com/parisholley/wordpress-asynchronous-javascript/ SEO: async js, asynchronous js, async javascript Incompatibility This plugin will not work out the box with the following plugins (unless they are modified to support asynchronous loading). Jetpack by WordPress.com (social plugin) WP Most Popular
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C