Executive brief
WP Compress is a WordPress plugin used to optimize images and deliver content via a CDN. A security flaw allows attackers to trick the plugin into loading malicious scripts from an external server instead of the legitimate CDN. If a user, such as a site administrator, clicks a specially crafted link, the attacker can execute code in their browser, potentially leading to unauthorized actions or data theft.
Technical details
The WP Compress plugin fails to validate the 'test_zone' query parameter before using it to construct CDN asset URLs. An attacker can provide a malicious hostname in this parameter, which the plugin's loader script then uses to inject <script> elements pointing to an attacker-controlled origin. This results in Reflected Cross-Site Scripting (XSS). The vulnerability can be exploited by tricking any visitor into clicking a crafted URL, allowing for arbitrary JavaScript execution in the context of the victim's session. The issue is fixed in version 7.10.04.
Affected products
- WP Compress WP Compress – Image Optimizer < 7.10.04
Timeline
- 2026-07-02: disclosed
- 2026-07-23: advisory: NVD publication date