Reflected Cross-Site Scripting in WP Compress Plugin by WordPress

CVE-2024-12047

Summary

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is subject to a Reflected Cross-Site Scripting vulnerability. This issue arises from insufficient sanitization of input and output escaping related to the ‘custom_server’ parameter, affecting all versions up to 6.30.03. Attackers can exploit this vulnerability by injecting malicious web scripts into pages, which are executed when a victim clicks on a deceptive link crafted by the attacker. This poses serious security risks for users, particularly if they are tricked into taking an action that executes the script.

References