CVE-2026-9066: WP Compress Plugin XSS Vulnerability

CVE-2026-9066 Overview

CVE-2026-9066 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WP Compress WordPress plugin versions prior to 7.10.04. The plugin fails to validate a query parameter that controls the asset Content Delivery Network (CDN) host before using it to build URLs for JavaScript files emitted on the page. An attacker who crafts a malicious link can cause the plugin's loader to inject <script> elements referencing an attacker-controlled origin. When a visitor follows the link, arbitrary JavaScript executes in their browser session on the target site.

Critical Impact
Attackers can execute arbitrary JavaScript in a visitor's browser session on any WordPress site running WP Compress before 7.10.04, enabling session theft, credential harvesting, and site defacement.

Affected Products

WP Compress WordPress plugin versions prior to 7.10.04
WordPress sites with the WP Compress image and asset optimization plugin installed
Any visitor browsing an affected site who follows a crafted URL

Discovery Timeline

2026-07-23 - CVE-2026-9066 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-9066

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw in the WP Compress plugin's asset loader. The plugin accepts a query parameter that specifies the CDN host used to serve optimized JavaScript assets. Because the plugin does not validate or sanitize this parameter, an attacker can substitute an arbitrary origin under their control.

When a victim visits a URL containing the malicious parameter, the plugin renders <script> tags pointing to the attacker's server. The browser then loads and executes the attacker's JavaScript in the context of the target WordPress site. This gives the attacker access to cookies, session tokens, and Document Object Model (DOM) content available to the origin.

Reflected XSS attacks require user interaction. However, the crafted URL can be delivered through phishing emails, social media, or malicious advertisements. Successful exploitation can lead to account takeover of authenticated users, including administrators who trigger the payload.

Root Cause

The root cause is missing input validation on a query parameter that influences the URL of JavaScript files emitted by the plugin. The plugin trusts client-supplied input to construct script source attributes without allowlisting known CDN hosts or applying output encoding.

Attack Vector

Exploitation requires an attacker to craft a URL containing a manipulated CDN host parameter. The attacker then lures a victim into clicking the link. The plugin echoes the attacker-controlled origin into the page, causing the victim's browser to execute remote JavaScript hosted by the attacker.

No verified code examples are available. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-9066

Indicators of Compromise

Web server access logs containing requests with unusual values in the CDN host query parameter used by the WP Compress plugin
Outbound requests from visitor browsers to unfamiliar external domains serving JavaScript files during page loads
HTML responses from the WordPress site containing <script> tags referencing hosts that do not match the site's approved CDN

Detection Strategies

Inspect HTTP request logs for query parameters that contain URL-encoded external domains directed at pages rendered by WP Compress
Deploy a Web Application Firewall (WAF) rule that flags requests where CDN or host-related query parameters contain full URLs or suspicious characters
Compare rendered script sources against an allowlist of expected CDN origins to identify injected asset references

Monitoring Recommendations

Monitor referrer patterns and Content Security Policy (CSP) violation reports for scripts loaded from unauthorized origins
Alert on WordPress admin session activity originating from unexpected IP addresses following user clicks on external links
Track outbound DNS queries from client browsers to domains not associated with the site's legitimate infrastructure

How to Mitigate CVE-2026-9066

Immediate Actions Required

Update the WP Compress WordPress plugin to version 7.10.04 or later on all affected sites
Audit administrator and editor accounts for suspicious activity that may indicate session hijacking
Notify site users and require password resets if compromise is suspected

Patch Information

The vendor addressed CVE-2026-9066 in WP Compress version 7.10.04. The fix validates the CDN host query parameter before it is used to construct JavaScript URLs. Site administrators should apply the update through the WordPress plugin manager. See the WPScan Vulnerability Report for release details.

Workarounds

Deactivate the WP Compress plugin until the update to version 7.10.04 or later can be applied
Deploy a strict Content Security Policy (CSP) that restricts script sources to a defined allowlist of trusted CDN hosts
Configure a WAF rule to block requests containing external URLs in the plugin's CDN host query parameter

bash

# Example WordPress CLI command to update the plugin
wp plugin update wp-compress-image-optimizer --version=7.10.04