Executive brief
LiteSpeed Cache is a popular WordPress plugin that optimizes website performance by caching pages and media. A stored cross-site scripting vulnerability in versions up to 7.7 allows authenticated authors to inject malicious scripts into posts through crafted image tag attributes when specific media optimization features are enabled. These scripts execute whenever visitors view the affected pages, potentially compromising user accounts and stealing sensitive data.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the LiteSpeed Cache plugin's media optimization component. The root cause is a flawed regular expression used to strip `width` and `height` attributes from images when the "Lazy Load Images" and "Add Missing Sizes" features are both enabled. An authenticated attacker with Author-level or higher privileges can craft malicious `<img>` tag attributes containing JavaScript code and embed them in posts or pages. When unauthenticated visitors access the page, the inadequately sanitized attributes are rendered, causing the injected scripts to execute in the visitor's browser. The vulnerability was patched in version 7.8 (released March 3, 2026) and is not known to be actively exploited.
Affected products
- LiteSpeed Cache for WordPress up to and including 7.7
Timeline
- 2026-02-24: disclosed: WordFence alerted LiteSpeed to the vulnerability
- 2026-03-03: patched: Vulnerability patched and version 7.8 released to WordPress repository
- 2026-08-27: other: Public disclosure via CVE-2026-3129 and LiteSpeed security advisory
- 2026-08-28: other: NVD entry published