CVE-2013-6111: Cross-site scripting (XSS) vulnerability in the mod_pagespeed module 0.x, 1.0.22.7, 1.1.x, 1.24.1, 1.3.25.1...

Security readout for executives and security teams

This CVE affects older Google mod_pagespeed deployments for Apache. A remote attacker may be able to inject script or HTML into pages processed by the module, creating a cross-site scripting risk for site visitors. The public record does not provide CVSS scoring, detailed vectors, or evidence of active exploitation. Exposure is most likely on legacy Apache web servers still running affected mod_pagespeed versions. Modern environments are affected only if they retained these older module builds. Product CPE data is absent, so inventory must verify actual module presence and version. Medium priority for internet-facing legacy Apache sites, especially customer-facing portals. The business risk is visitor session compromise or brand damage from injected content. Urgency is lower where mod_pagespeed is absent, upgraded, or not exposed publicly. Mitigation focus: Inventory Apache servers for mod_pagespeed and exact module versions.; Compare deployed versions with the affected ranges listed in the CVE.; Check the mod_pagespeed announcement and vendor guidance for fixed or supported releases..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.