CVE-2026-9066 in WP Compress Plugin
Summary
by MITRE • 07/23/2026
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability in WP Compress WordPress plugin versions prior to 7.10.04 represents a critical reflected cross-site scripting flaw that stems from inadequate input validation within the plugin's asset handling mechanism. This issue falls under the CWE-79 category of Cross-Site Scripting, specifically manifesting as a reflected XSS vulnerability where user-supplied data is improperly sanitized before being incorporated into dynamically generated web content. The vulnerability occurs when the plugin processes a query parameter that determines the CDN host for JavaScript assets, failing to validate or sanitize this input before constructing URLs that are subsequently injected into page responses.
The technical exploitation of this vulnerability relies on manipulating a specific query parameter that controls the asset CDN host configuration within the WP Compress plugin. When an attacker crafts a malicious URL containing crafted script tags or malicious payloads within this parameter, the plugin's loader component fails to validate the input and directly incorporates it into the generated JavaScript URLs. This allows the attacker to inject arbitrary script elements pointing to attacker-controlled origins, effectively bypassing the browser's security mechanisms that normally prevent cross-site scripting attacks.
The operational impact of this vulnerability extends beyond simple data theft or session hijacking, as it provides attackers with complete control over user sessions within the target WordPress environment. When visitors navigate to a crafted link containing malicious payloads, the plugin's loader injects script elements that execute arbitrary JavaScript code within the context of the victim's browser session. This enables attackers to perform actions such as stealing cookies, modifying page content, redirecting users to malicious sites, or even executing more sophisticated attacks like credential harvesting or privilege escalation within the WordPress administration interface.
This vulnerability aligns with several ATT&CK techniques including T1566.001 for initial access through spearphishing attachments and T1059.007 for command and scripting interpreter using PowerShell, as attackers can leverage the reflected XSS to establish persistent access or conduct more complex attacks. The flaw represents a classic example of improper input validation, where the plugin fails to implement proper sanitization or encoding of user-supplied parameters before incorporating them into executable code contexts.
Mitigation strategies should prioritize immediate patching to version 7.10.04 or later, which addresses the input validation deficiency in the asset CDN host parameter handling. Additionally, administrators should implement Content Security Policy headers to limit script execution sources and consider implementing Web Application Firewalls that can detect and block malicious query parameters. Regular security audits of WordPress plugins should include validation of input handling mechanisms, particularly for parameters used in URL construction or dynamic content generation. The vulnerability demonstrates the critical importance of input sanitization and output encoding practices as recommended by OWASP and other security frameworks, emphasizing that all user-supplied data must be properly validated and escaped before being incorporated into web responses to prevent injection attacks across multiple attack vectors including reflected XSS scenarios.