WordPress ImageRecycle pdf & image compression Plugin <= 3.1.10 is vulnerable to Cross Site Scripting (XSS)

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in the ImageRecycle pdf & image compression plugin for WordPress versions 3.1.10 and earlier [1]. The vulnerability is triggered via user-supplied input that is not properly sanitized before being reflected back to the user, allowing an attacker to inject arbitrary JavaScript code.

Exploitation

An attacker can exploit this vulnerability without authentication by crafting a malicious URL containing the XSS payload. The victim must be tricked into clicking the link or visiting the crafted URL while logged into WordPress, causing the malicious script to execute in the context of the victim's session.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser. This can lead to session hijacking, data theft, or defacement of the WordPress admin interface, as the script runs with the victim's privileges.

Mitigation

Upgrade to version 3.1.11 or later (currently 3.1.18) to mitigate the vulnerability [1]. No workaround is available without updating the plugin.