Is CVE-2026-109215 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109215 being exploited in the wild.

How severe is CVE-2026-109215?

Medium severity, with a CVSS score of 6.4, published 29 October 2026.

Which products and versions are affected?

LiteSpeed Technologies LiteSpeed Cache up to and including 7.9.1.

Is there a fix for CVE-2026-109215?

Yes: fixed in 7.9.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109215 attacked?

It is attacked over the network.

Am I affected by CVE-2026-109215?

Check whether you run LiteSpeed Technologies LiteSpeed Cache at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109215: LiteSpeed Cache WordPress plugin stored XSS in VPI

CVE-2026-109215 · Severity: medium · CVSS 6.4 · Published 2026-10-29

The LiteSpeed Cache plugin for WordPress, used for site performance optimization, contains a stored cross-site scripting (XSS) vulnerability in its Viewport Images (VPI) feature. Authenticated attackers with subscriber-level access can inject malicious scripts into pages by embedding crafted img tags in user-generated content like bbPress replies, which execute when other users view those pages. This requires the site administrator to have enabled the VPI feature with specific configuration.

Vendors: LiteSpeed Technologies.

Quick answers

Is CVE-2026-109215 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109215 being exploited in the wild.
How severe is CVE-2026-109215?: Medium severity, with a CVSS score of 6.4, published 29 October 2026.
Which products and versions are affected?: LiteSpeed Technologies LiteSpeed Cache up to and including 7.9.1.
Is there a fix for CVE-2026-109215?: Yes: fixed in 7.9.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109215 attacked?: It is attacked over the network.
Am I affected by CVE-2026-109215?: Check whether you run LiteSpeed Technologies LiteSpeed Cache at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 7.9.2

Technical details

The vulnerability exists in the VPI component's handling of the 'bbp_reply_content' parameter, where insufficient input sanitization and output escaping of image attribute values allows script injection. An authenticated subscriber can embed raw img tags in bbPress replies with specially crafted attributes that, when the VPI feature parses and rebuilds the image markup, break out of attribute context and inject arbitrary HTML/JavaScript. The fix validates attribute names and escapes attribute values when reconstructing image markup to prevent attribute injection attacks.

Affected products

LiteSpeed Technologies LiteSpeed Cache up to and including 7.9.1

Timeline

2026-10-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.