The WP Compress WordPress plugin, versions before 7.10.04, accepts a request parameter that specifies the CDN host without performing any validation. When the plugin constructs URLs for JavaScript files that it emits on the page, it incorporates that untrusted value directly. An attacker can therefore craft a URL containing malicious script references; when a site visitor follows the link, the plugin emits script elements that load from an attacker‑controlled origin. This causes arbitrary JavaScript to execute in the visitor’s browser session, allowing credential theft, session hijack, or other typical XSS effects.

Any WordPress site that has the WP Compress plugin installed and running a version earlier than 7.10.04 is affected, regardless of the hosting environment or operating system.

The CVSS score of 6.1 reflects a medium severity vulnerability. The EPSS score of 0.00149 indicates a low likelihood of exploitation at present, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack requires a victim to click a crafted URL, making this a classic reflected XSS vector that can be abused against site visitors.