CyberRota Analysis
AI-GeneratedThe WP Compress WordPress plugin prior to version 7.10.04 is vulnerable to reflected cross-site scripting (XSS) due to inadequate validation of a query parameter that specifies the asset CDN host. This flaw allows attackers to craft malicious links that, when clicked by a visitor, can execute arbitrary JavaScript in the context of the target site, potentially compromising user sessions. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of exploitation.
Original NVD Description
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.