WP Compress CVE-2026-9066

WP Compress plugin (version before 7.10.04) must be installed and active on the target WordPress site. The specific vulnerable condition is that the plugin's asset loader processes a query parameter specifying the CDN host and uses its value without validation to construct script src attributes emitted into the page response. Active user interaction is required: the victim must follow a crafted link containing the malicious CDN host value (UI:R per CVSS). No authentication is required of the attacker or victim - any site visitor can be targeted. Exploitation is limited by the mandatory user interaction, preventing automated or mass exploitation per SSVC 'Automatable: no'. No special server-side configuration beyond plugin activation is required. The highest-impact scenario involves targeting a logged-in WordPress administrator, as their session context grants elevated privileges.

The CVSS 6.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) accurately reflects the attack profile: network-reachable with no authentication or privilege required, low complexity, but requiring a victim to click a crafted link (UI:R), with cross-site scope change and limited confidentiality and integrity impact. EPSS at 0.20% (11th percentile) indicates that despite public POC availability, mass exploitation has not been observed, which is consistent with SSVC's 'Automatable: no' - the mandatory user interaction prevents bulk targeting. No CISA KEV listing confirms no confirmed widespread exploitation. The realistic threat is a targeted social-engineering campaign against WordPress administrators, whose session tokens would grant the attacker elevated site privileges. The non-automatable nature and UI dependency substantially reduce broad-based risk compared to the raw CVSS score might suggest, but WordPress plugin XSS against admins has historically been a reliable lateral-movement vector in site takeover chains.

An attacker identifies a WordPress site running WP Compress prior to 7.10.04 and crafts a URL embedding a malicious value for the CDN host query parameter pointing to an attacker-controlled domain. The attacker distributes this link via phishing email or social media targeting the site's visitors or administrators; when the victim clicks the link, the plugin renders script tags sourcing JavaScript from the attacker's server, which executes in the victim's browser within the WordPress site's security context, enabling session token theft or admin-action hijacking. A publicly available proof-of-concept exists, lowering the bar for exploitation.