Read the docs
TI-2026-07967 Aliases CVE-2026-9066GHSA-w2pp-vvh7-8jx9

WP Compress < 7.10.04 - Reflected XSS via test_zone

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00253 16th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed WP Compress (Unknown): 7.10.04

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWP Compressbefore 7.10.047.10.04Patch availableCNA
  • WP Compress VendorUnknown Affected before 7.10.04 Fixed in 7.10.04 Patch available CNA

Remediation

  • Fix · CNA WP Compress (Unknown) Fixed in 7.10.04

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9066
  2. 2026-10-03 Alias added: GHSA-w2pp-vvh7-8jx9

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences