CVE-2026-9066: CWE-79 Cross-Site Scripting (XSS) in WP Compress
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.
AI Analysis
Technical Summary
The WP Compress WordPress plugin versions prior to 7.10.04 do not properly validate the value of a query parameter used to specify the asset CDN host. This lack of validation leads to a reflected cross-site scripting (CWE-79) vulnerability. When a visitor clicks a crafted link containing a malicious CDN host parameter, the plugin's loader injects script elements referencing the attacker-controlled origin. This results in arbitrary JavaScript execution within the visitor's browser session on the target site.
Potential Impact
An attacker can execute arbitrary JavaScript code in the context of a visitor's session on a site using a vulnerable version of the WP Compress plugin. This may lead to session hijacking, defacement, or other malicious actions performed on behalf of the victim user.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted query parameters to control asset CDN hosts or consider disabling the affected functionality if possible.
CVE-2026-9066: CWE-79 Cross-Site Scripting (XSS) in WP Compress
Description
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.
CVSS v3.1
Score 6.1medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WP Compress WordPress plugin versions prior to 7.10.04 do not properly validate the value of a query parameter used to specify the asset CDN host. This lack of validation leads to a reflected cross-site scripting (CWE-79) vulnerability. When a visitor clicks a crafted link containing a malicious CDN host parameter, the plugin's loader injects script elements referencing the attacker-controlled origin. This results in arbitrary JavaScript execution within the visitor's browser session on the target site.
Potential Impact
An attacker can execute arbitrary JavaScript code in the context of a visitor's session on a site using a vulnerable version of the WP Compress plugin. This may lead to session hijacking, defacement, or other malicious actions performed on behalf of the victim user.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted query parameters to control asset CDN hosts or consider disabling the affected functionality if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-05-20T08:42:05.343Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a61ba439c2644c7f88d5fd7
Added to database: 07/23/2026, 06:52:51 UTC
Last enriched: 07/23/2026, 07:07:07 UTC
Last updated: 09/04/2026, 22:52:15 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.