Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-9066— WP Compress < 7.10.04 - Reflected XSS via test_zone

Quick assessment

Affected
Unknown WP Compress
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

wpcompress wp compress是wpcompress个人开发者的一套网站压缩优化工具。 WordPress wp compress 7.10.04之前版本存在跨站脚本漏洞，该漏洞源于未验证控制资产CDN主机的查询参数值，导致反射型跨站脚本。当访问者点击特制链接时，加载器会注入指向攻击者控制来源的脚本元素，使得攻击者能够在目标站点上执行任意JavaScript脚本。

AI Predicted 6.1 Difficulty: Easy EPSS 0.25% · P15

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown WP Compress < 7.10.04 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-9066

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WP Compress < 7.10.04 - Reflected XSS via test_zone
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress wp compress 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
wpcompress wp compress是wpcompress个人开发者的一套网站压缩优化工具。 WordPress wp compress 7.10.04之前版本存在跨站脚本漏洞，该漏洞源于未验证控制资产CDN主机的查询参数值，导致反射型跨站脚本。当访问者点击特制链接时，加载器会注入指向攻击者控制来源的脚本元素，使得攻击者能够在目标站点上执行任意JavaScript脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown WP Compress 0 ~ 7.10.04 -

II. Public POCs for CVE-2026-9066

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-9066

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-9066 (1)

Same Patch Batch · Unknown · 2026-07-23 · 4 CVEs total

CVE-2026-12082 Praison AI SEO < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Mo
CVE-2026-9577 Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter
CVE-2026-14291 Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa

IV. Related Vulnerabilities

Same product: WP Compress
Same vendor: Unknown

V. Comments for CVE-2026-9066

No comments yet

Leave a comment