LiteSpeed Cache <= 7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Attributes
- ID
- WPSEC-2026-1394
- Plugin
- LiteSpeed Cache (litespeed-cache)
- Affected
- from 7.6 before 7.9.2
- Remediation
- Update to 7.9.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-21
- Attack surface
- LiteSpeed Cache on WPSec AttackSurface
- Fix released
- Published
Description
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image tag attributes in all versions from 7.6 up to, and including, 7.9.1. This is due to insufficient output escaping when the plugin rebuilds viewport (VPI) image tags to add the fetchpriority and decoding attributes: parsed attribute values are re-emitted inside double quotes without escaping, so a single-quoted value containing double quotes breaks out of the attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page. Exploitation requires Viewport Images to be in use for that page.
References
- https://wpsec.com/vuln/WPSEC-2026-1394/
- https://plugins.svn.wordpress.org/litespeed-cache/tags/7.9.2/
- https://wordpress.org/plugins/litespeed-cache/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS