Reflected XSS in WP Compress WordPress Plugin

Executive Summary

This is a Reflected Cross-Site Scripting (XSS) vulnerability in the WP Compress – Image Optimizer WordPress plugin versions before 7.10.04. It occurs because the plugin does not properly validate the test_zone query parameter used to set the CDN host for JavaScript files. Attackers can craft malicious links with a rogue test_zone value that causes the plugin to load scripts from an attacker-controlled domain, executing arbitrary JavaScript in visitors' browsers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your WP Compress plugin version is below 7.10.04. Look for unusual JavaScript injections in web pages served by the plugin. Test by appending a malicious test_zone parameter to URLs, such as ?test_zone=malicious.example.com, and observe if scripts load from unexpected origins.

Useful 0 Not Useful 0

Impact Analysis

If you visit a website running a vulnerable version of WP Compress, an attacker could trick you into clicking a specially crafted link. This could allow the attacker to run malicious scripts in your browser session, potentially stealing cookies, session tokens, or other sensitive data. It affects all visitors, including logged-in users, increasing the risk of account compromise or data theft.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized script execution in user sessions, potentially enabling data theft or manipulation. For GDPR, this may result in violations of Article 32 (security of processing) if user data is compromised. HIPAA-covered entities might face breaches of protected health information if session data is accessed.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the WP Compress plugin to version 7.10.04 or later. If updating is not possible, disable the plugin until the update is applied. Review server logs for signs of exploitation attempts targeting the test_zone parameter.

Useful 0 Not Useful 0