The WP Compress – Instant Performance & Speed Optimization plugin for WordPress suffers from a reflected cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'custom_server' parameter. This vulnerability affects all versions up to 6.30.03. An attacker can craft a malicious URL containing script code in this parameter, which is then reflected in a web page without proper sanitization or escaping, leading to script execution in the context of the victim's browser. The vulnerability requires user interaction (clicking a link) and does not require authentication. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other actions performed with the victim's privileges on the affected site. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid clicking on suspicious links that may exploit this vulnerability. Monitoring vendor channels for updates and applying any forthcoming patches promptly is recommended.