Is CVE-2026-3129 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3129 being exploited in the wild.

How severe is CVE-2026-3129?

Medium severity, with a CVSS score of 6.4, published 28 August 2026.

Which products and versions are affected?

LiteSpeed Cache for WordPress up to and including 7.7.

Is there a fix for CVE-2026-3129?

A patch was published on 2026-03-03: Vulnerability patched and version 7.8 released to WordPress repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3129 attacked?

It is attacked over the network.

Am I affected by CVE-2026-3129?

Check whether you run LiteSpeed Cache for WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3129: LiteSpeed Cache for WordPress stored cross-site scripting in image attributes

CVE-2026-3129 · Severity: medium · CVSS 6.4 · Published 2026-08-28

LiteSpeed Cache is a popular WordPress plugin that optimizes website performance by caching pages and media. A stored cross-site scripting vulnerability in versions up to 7.7 allows authenticated authors to inject malicious scripts into posts through crafted image tag attributes when specific media optimization features are enabled. These scripts execute whenever visitors view the affected pages, potentially compromising user accounts and stealing sensitive data.

Technologies: LiteSpeed Cache for WordPress. Vendors: LiteSpeed.

Quick answers

Is CVE-2026-3129 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3129 being exploited in the wild.
How severe is CVE-2026-3129?: Medium severity, with a CVSS score of 6.4, published 28 August 2026.
Which products and versions are affected?: LiteSpeed Cache for WordPress up to and including 7.7.
Is there a fix for CVE-2026-3129?: A patch was published on 2026-03-03: Vulnerability patched and version 7.8 released to WordPress repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3129 attacked?: It is attacked over the network.
Am I affected by CVE-2026-3129?: Check whether you run LiteSpeed Cache for WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the LiteSpeed Cache plugin's media optimization component. The root cause is a flawed regular expression used to strip `width` and `height` attributes from images when the "Lazy Load Images" and "Add Missing Sizes" features are both enabled. An authenticated attacker with Author-level or higher privileges can craft malicious `<img>` tag attributes containing JavaScript code and embed them in posts or pages. When unauthenticated visitors access the page, the inadequately sanitized attributes are rendered, causing the injected scripts to execute in the visitor's browser. The vulnerability was patched in version 7.8 (released March 3, 2026) and is not known to be actively exploited.

Affected products

LiteSpeed Cache for WordPress up to and including 7.7

Timeline

2026-02-24: disclosed: WordFence alerted LiteSpeed to the vulnerability
2026-03-03: patched: Vulnerability patched and version 7.8 released to WordPress repository
2026-08-27: other: Public disclosure via CVE-2026-3129 and LiteSpeed security advisory
2026-08-28: other: NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.