CVE-2024-12047: WP Compress XSS Vulnerability

CVE-2024-12047 Overview

CVE-2024-12047 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WP Compress – Instant Performance & Speed Optimization plugin for WordPress. The flaw exists in the custom_server parameter and affects all versions up to and including 6.30.03. The plugin fails to properly sanitize input and escape output, allowing unauthenticated attackers to inject arbitrary JavaScript into rendered pages. Successful exploitation requires tricking a user into clicking a crafted link. The issue is tracked under CWE-79 and was published to the National Vulnerability Database (NVD) on January 4, 2025.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and administrative action abuse when administrators are targeted.

Affected Products

WP Compress – Instant Performance & Speed Optimization plugin for WordPress
All versions up to and including 6.30.03
Vulnerable code path: addons/cdn/cdn-rewrite.php

Discovery Timeline

2025-01-04 - CVE-2024-12047 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12047

Vulnerability Analysis

The vulnerability is a classic Reflected Cross-Site Scripting (XSS) issue in the WP Compress WordPress plugin. The custom_server parameter accepted via HTTP request is reflected back into the HTML response without adequate sanitization or output escaping. An attacker crafts a URL containing malicious JavaScript in the custom_server parameter and lures a victim into clicking it. When the victim's browser renders the response, the injected script executes within the origin of the WordPress site. Exploitation requires user interaction but no authentication, which broadens the pool of potential victims. The scope change in the attack indicates that the injected script can affect resources beyond the initially vulnerable component, including administrative sessions.

Root Cause

The root cause is insufficient input sanitization and output escaping in the CDN rewrite logic. The affected code is referenced in plugins.trac.wordpress.org cdn-rewrite.php at line 459. User-controlled data from the custom_server parameter is concatenated into HTML output without applying WordPress sanitization functions such as esc_attr(), esc_html(), or sanitize_text_field(). This maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL targeting the vulnerable endpoint of a WordPress site running WP Compress and embeds a JavaScript payload in the custom_server query parameter. The attacker delivers the link through phishing emails, social media, forum posts, or malicious advertisements. When a logged-in administrator or privileged user clicks the link, the reflected payload executes in their browser context. The attacker can then exfiltrate cookies, hijack sessions, perform actions as the user, or inject secondary payloads such as rogue administrator accounts.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Analysis for additional technical details.

Detection Methods for CVE-2024-12047

Indicators of Compromise

Web server access logs containing custom_server= parameter values with HTML tags, URL-encoded script content, or JavaScript event handlers such as onerror, onload, or onclick.
Requests to WP Compress endpoints referencing cdn-rewrite.php with unusually long or encoded query strings.
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains following interaction with suspicious links.
Creation of new administrator accounts or modification of plugin settings shortly after an admin clicked an external link.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule to flag requests where the custom_server parameter contains <, >, script, javascript:, or encoded equivalents.
Review WordPress audit logs for anomalous administrator activity correlated with inbound referrer URLs from external domains.
Hunt for reflected XSS patterns in HTTP response bodies that echo request parameters verbatim into HTML attributes or script contexts.

Monitoring Recommendations

Enable verbose HTTP request logging on WordPress sites and forward logs to a centralized SIEM for query-parameter inspection.
Alert on repeated requests to the same vulnerable endpoint from a single source address with varying custom_server payloads.
Monitor WordPress administrator account creation events and plugin configuration changes in near real time.

How to Mitigate CVE-2024-12047

Immediate Actions Required

Update the WP Compress – Instant Performance & Speed Optimization plugin to a version newer than 6.30.03 that includes the fix from WordPress Changeset #3213738.
If an update cannot be applied immediately, deactivate and remove the plugin until a patched version is deployed.
Rotate WordPress administrator session cookies and reset passwords if administrators may have interacted with suspicious links.
Audit WordPress user accounts for unauthorized administrator additions.

Patch Information

The vendor addressed the vulnerability in a release following version 6.30.03. The remediation is tracked in WordPress Changeset #3213738. Refer to the WP Compress Image Optimizer plugin page for the latest release and changelog information.

Workarounds

Deploy WAF rules that block or sanitize requests containing script tags, JavaScript URIs, or HTML event handlers in the custom_server parameter.
Enforce Content Security Policy (CSP) headers that restrict inline script execution and limit script sources to trusted origins.
Educate administrators and privileged users to avoid clicking untrusted links to their WordPress site, particularly from external referrers.
Restrict administrative access to the WordPress backend using IP allowlists or VPN requirements to reduce exposure of privileged sessions.