WordPress plugin
WP Compress – Instant Performance & Speed Optimization security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 19 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High3
- Medium14
- Low0
All WP Compress – Instant Performance & Speed Optimization vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.8 | Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint ≤7.25.00Update to 7.26.00 | CVE-2026-104755 | |
| Medium5.3 | Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters ≤7.22.01Update to 7.22.38 | CVE-2026-120551 | |
| Medium5.3 | Missing Authorization to Unauthenticated Settings Update ≤7.21.28Update to 7.22.0 | CVE-2026-84757 | |
| Critical9.8 | Unauthenticated Remote Code Execution <7.20.01Update to 7.20.01 | CVE-2026-73343 | |
| Medium6.5 | Cross-Site Request Forgery to Arbitrary Options Deletion ≤7.10.09Update to 7.20.01 | CVE-2026-17608 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤7.10.3Update to 7.10.04 | CVE-2026-9066 | |
| Medium5.3 | Missing Authorization ≤6.60.28Update to 6.60.29 | CVE-2026-25370 | |
| Medium5.3 | Missing Authorization ≤6.50.54Update to 6.50.55 | CVE-2025-57899 | |
| High7.3 | Unauthenticated Broken Authentication ≤6.30.30Update to 6.30.31 | CVE-2025-47479 | |
| Medium4.3 | Cross-Site Request Forgery ≤6.30.30Update to 6.30.31 | CVE-2025-47546 | |
| High8.8 | Authenticated (Subscriber+) Missing Authorization via Multiple Functions ≤6.30.15Update to 6.30.16 | CVE-2025-2110 | |
| Medium5.8 | Unauthenticated Server-Side Request Forgery via init Function ≤6.30.15Update to 6.30.16 | CVE-2025-2109 | |
| Medium6.1 | Reflected Cross-Site Scripting via custom_server Parameter ≤6.30.03Update to 6.30.04 | CVE-2024-12047 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤6.20.13Update to 6.21.01 | CVE-2024-47384 | |
| Medium4.3 | Open Redirect via css ≤6.20.01Update to 6.20.02 | CVE-2023-6812 | |
| Medium6.5 | Missing Authorization ≤6.20.01Update to 6.20.02 | CVE-2024-4445 | |
| Medium4.3 | Cross-Site Request Forgery ≤6.10.35Update to 6.11.01 | CVE-2024-32106 | |
| High7.5 | Missing Authorization to Unauthenticated CDN Modification ≤6.11.10Update to 6.11.11 | CVE-2024-1934 | |
| Critical9.1 | Unauthenticated Directory Traversal via css ≤6.10.33Update to 6.10.34 | CVE-2023-6699 |
- Medium4.8Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint
≤7.25.00Update to 7.26.00
- Medium5.3Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters
≤7.22.01Update to 7.22.38
- Medium5.3Missing Authorization to Unauthenticated Settings Update
≤7.21.28Update to 7.22.0
- Critical9.8Unauthenticated Remote Code Execution
<7.20.01Update to 7.20.01
- Medium6.5Cross-Site Request Forgery to Arbitrary Options Deletion
≤7.10.09Update to 7.20.01
- Medium6.1Reflected Cross-Site Scripting
≤7.10.3Update to 7.10.04
- Medium5.3Missing Authorization
≤6.60.28Update to 6.60.29
- Medium5.3Missing Authorization
≤6.50.54Update to 6.50.55
- High7.3Unauthenticated Broken Authentication
≤6.30.30Update to 6.30.31
- Medium4.3Cross-Site Request Forgery
≤6.30.30Update to 6.30.31
- High8.8Authenticated (Subscriber+) Missing Authorization via Multiple Functions
≤6.30.15Update to 6.30.16
- Medium5.8Unauthenticated Server-Side Request Forgery via init Function
≤6.30.15Update to 6.30.16
- Medium6.1Reflected Cross-Site Scripting via custom_server Parameter
≤6.30.03Update to 6.30.04
- Medium6.1Reflected Cross-Site Scripting
≤6.20.13Update to 6.21.01
- Medium4.3Open Redirect via css
≤6.20.01Update to 6.20.02
- Medium6.5Missing Authorization
≤6.20.01Update to 6.20.02
- Medium4.3Cross-Site Request Forgery
≤6.10.35Update to 6.11.01
- High7.5Missing Authorization to Unauthenticated CDN Modification
≤6.11.10Update to 6.11.11
- Critical9.1Unauthenticated Directory Traversal via css
≤6.10.33Update to 6.10.34
WP Compress – Instant Performance & Speed Optimization: common questions
Does WP Compress – Instant Performance & Speed Optimization have known vulnerabilities?
Yes. VulnCrest Radar lists 19 known vulnerabilities in WP Compress – Instant Performance & Speed Optimization: 2 critical, 3 high, 14 medium. None are known to affect version null.
How do I check which version of WP Compress – Instant Performance & Speed Optimization I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP Compress – Instant Performance & Speed Optimization vulnerability?
CVE-2026-104755, published Oct 15, 2026: WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint. Severity: Medium (CVSS 4.8).
Is any WP Compress – Instant Performance & Speed Optimization vulnerability listed in CISA KEV?
No. None of the known WP Compress – Instant Performance & Speed Optimization vulnerabilities is currently listed in the CISA KEV catalog.