Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-9066 Reflected XSS in WP Compress WordPress Plugin Before 7.10.04 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9066
Post summary
The CVE‑2026‑9066 refers to a reflected XSS flaw in WP Compress WordPress plugin versions prior to 7.10.04; no PoC, exploit, or patch details are provided in the snippet.