CVE-2026-9066— WordPress wp compress 跨站脚本漏洞

WP Compress < 7.10.04 - Reflected XSS via test_zone

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.

N/A

N/A

WordPress wp compress 跨站脚本漏洞

wpcompress wp compress是wpcompress个人开发者的一套网站压缩优化工具。 WordPress wp compress 7.10.04之前版本存在跨站脚本漏洞，该漏洞源于未验证控制资产CDN主机的查询参数值，导致反射型跨站脚本。当访问者点击特制链接时，加载器会注入指向攻击者控制来源的脚本元素，使得攻击者能够在目标站点上执行任意JavaScript脚本。

N/A

N/A