EUVD-2026-47886
GHSA-w2pp-vvh7-8jx9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reflected XSS requires victim to follow a crafted link (UI:R), achieves cross-site scope via browser script injection (S:C), with limited C/I impact and no availability impact consistent with XSS.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.
AnalysisAI
Reflected XSS in WP Compress WordPress plugin (versions before 7.10.04) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious link that injects the attacker's domain as the CDN host for script assets. The plugin's loader emits script elements pointing to the attacker-controlled origin without sanitizing the CDN host query parameter, achieving cross-site scope execution within the target WordPress site. Publicly available exploit code exists per WPScan reporting; no active exploitation is confirmed in CISA KEV, and EPSS is low at 0.20% (11th percentile), consistent with SSVC's 'poc, non-automatable, partial impact' classification.
Technical ContextAI
WP Compress is a WordPress performance optimization plugin that offloads static asset delivery to a CDN. The vulnerability arises in its asset loader, which reads a query parameter specifying the CDN host and uses it verbatim to construct the src attributes of script elements emitted into the page DOM. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) identifies the root cause: unsanitized user-supplied input flowing into HTML output. Because the injected scripts load from a fully attacker-controlled origin rather than embedding inline JavaScript, the attack bypasses common inline-script defenses and causes the victim's browser to fetch and execute arbitrary code from the attacker's server. The CPE identifier cpe:2.3:a:unknown:wp_compress:*:*:*:*:*:*:*:* covers all versions prior to 7.10.04; the vendor field is listed as 'unknown' in official NVD CPE data, indicating incomplete vendor normalization.
RemediationAI
Update WP Compress to version 7.10.04 or later, which resolves the unvalidated CDN host parameter; this is a vendor-released patch confirmed by the WPScan advisory at https://wpscan.com/vulnerability/133e2ca0-8cde-4b59-b680-0ddf95004625/. If immediate patching is not possible, disable or deactivate the WP Compress plugin entirely until the update can be applied - this eliminates the attack surface at the cost of CDN-accelerated asset delivery. Alternatively, a WAF rule blocking or stripping the vulnerable CDN host query parameter from inbound requests provides a partial compensating control, but may break legitimate CDN rewriting functionality and is not a substitute for patching. Restricting plugin management to trusted admin accounts reduces the blast radius if a victim is targeted while authenticated.
More in Wp Compress
View allRemote code execution in the WP Compress (Image Optimizer) WordPress plugin before version 7.20.01 allows unauthenticate
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, mo
The WP Compress - Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missi
The WP Compress - Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data d
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request For
The WP Compress - Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to,
Cross-Site Request Forgery (CSRF) vulnerability in WP Compress WP Compress - Image Optimizer [All-In-One].10.35. Rated m
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Sc
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today