CVE-2026-9066
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The WP Compress WordPress plugin before version 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build URLs of JavaScript files, leading to Reflected XSS. When a visitor follows a crafted link, the plugin's loader injects script elements pointing to an attacker-controlled origin, allowing arbitrary JavaScript execution in the visitor's session on the target site.
Risk Assessment
The organization is at risk of XSS attacks that can lead to session hijacking, data theft, or further attacks by luring victims to a crafted link.
Recommendation
Immediately update the WP Compress plugin to version 7.10.04 or later.
Other vulnerabilities in WP Compress
See all- CVE-2026-73343Critical
An unauthenticated attacker can remotely execute arbitrary code (RCE) in WP Compress versions prior to 7.20.01.
- CVE-2026-17608Medium
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress up to version 7.10.09 is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation. Unauthenticated attackers can trick an administrator into performing an action that deletes arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset.
Original NVD description (English source)
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.