CVE-2026-9066

Name of the Vulnerable Software and Affected Versions WP Compress versions prior to 7.10.04

Description Insufficient validation of a query parameter that controls the asset CDN host allows for Reflected XSS (Cross-Site Scripting), a flaw where malicious scripts are reflected off a web application to the victim's browser. The loader injects script elements pointing to an attacker-controlled origin via the test zone parameter, enabling the execution of arbitrary JavaScript within the visitor's session on the target site.

Recommendations Update WP Compress to version 7.10.04 or later. Avoid using the test zone parameter in the affected plugin until the update is applied.