Wp Compress
Monthly
Unauthenticated settings modification in the WP Compress WordPress plugin (versions <= 7.21.28) allows any remote attacker without credentials to alter plugin configuration, potentially redirecting CDN endpoints, disabling image optimization, or manipulating performance settings site-wide. The flaw stems from missing authorization checks (CWE-862) on settings-update endpoints, meaning any internet-reachable WordPress installation running the affected plugin is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity attack vector makes this trivially exploitable by automated scanners.
Remote code execution in the WP Compress (Image Optimizer) WordPress plugin before version 7.20.01 allows unauthenticated attackers to inject and execute arbitrary PHP code on the underlying web server. Reported by Patchstack (EUVD-2026-60774) and rated CVSS 10.0 with a network, no-privilege, no-interaction vector, this is a maximum-severity flaw affecting every deployment running a vulnerable plugin version. No public exploit identified at time of analysis, though the code-injection root cause and unauthenticated reachability make it a high-priority patch target.
Reflected XSS in WP Compress WordPress plugin (versions before 7.10.04) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious link that injects the attacker's domain as the CDN host for script assets. The plugin's loader emits script elements pointing to the attacker-controlled origin without sanitizing the CDN host query parameter, achieving cross-site scope execution within the target WordPress site. Publicly available exploit code exists per WPScan reporting; no active exploitation is confirmed in CISA KEV, and EPSS is low at 0.20% (11th percentile), consistent with SSVC's 'poc, non-automatable, partial impact' classification.
A security vulnerability in AresIT WP Compress allows Authentication Abuse (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Cross-Site Request Forgery (CSRF) vulnerability in AresIT WP Compress allows Cross Site Request Forgery.30.30. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Reflected XSS.20.13. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Compress - Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the several functions in versions up to,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Compress - Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-Site Request Forgery (CSRF) vulnerability in WP Compress WP Compress - Image Optimizer [All-In-One].10.35. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Compress - Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wps_local_compress::__construct' function in all. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Compress - Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Unauthenticated settings modification in the WP Compress WordPress plugin (versions <= 7.21.28) allows any remote attacker without credentials to alter plugin configuration, potentially redirecting CDN endpoints, disabling image optimization, or manipulating performance settings site-wide. The flaw stems from missing authorization checks (CWE-862) on settings-update endpoints, meaning any internet-reachable WordPress installation running the affected plugin is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity attack vector makes this trivially exploitable by automated scanners.
Remote code execution in the WP Compress (Image Optimizer) WordPress plugin before version 7.20.01 allows unauthenticated attackers to inject and execute arbitrary PHP code on the underlying web server. Reported by Patchstack (EUVD-2026-60774) and rated CVSS 10.0 with a network, no-privilege, no-interaction vector, this is a maximum-severity flaw affecting every deployment running a vulnerable plugin version. No public exploit identified at time of analysis, though the code-injection root cause and unauthenticated reachability make it a high-priority patch target.
Reflected XSS in WP Compress WordPress plugin (versions before 7.10.04) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious link that injects the attacker's domain as the CDN host for script assets. The plugin's loader emits script elements pointing to the attacker-controlled origin without sanitizing the CDN host query parameter, achieving cross-site scope execution within the target WordPress site. Publicly available exploit code exists per WPScan reporting; no active exploitation is confirmed in CISA KEV, and EPSS is low at 0.20% (11th percentile), consistent with SSVC's 'poc, non-automatable, partial impact' classification.
A security vulnerability in AresIT WP Compress allows Authentication Abuse (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Cross-Site Request Forgery (CSRF) vulnerability in AresIT WP Compress allows Cross Site Request Forgery.30.30. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Reflected XSS.20.13. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Compress - Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the several functions in versions up to,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Compress - Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-Site Request Forgery (CSRF) vulnerability in WP Compress WP Compress - Image Optimizer [All-In-One].10.35. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Compress - Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wps_local_compress::__construct' function in all. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Compress - Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.