{
 "id": "WPSEC-2026-1394",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1394/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1394/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1394/index.md",
 "title": "LiteSpeed Cache <= 7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Attributes",
 "description": "The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image tag attributes in all versions from 7.6 up to, and including, 7.9.1. This is due to insufficient output escaping when the plugin rebuilds viewport (VPI) image tags to add the fetchpriority and decoding attributes: parsed attribute values are re-emitted inside double quotes without escaping, so a single-quoted value containing double quotes breaks out of the attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page. Exploitation requires Viewport Images to be in use for that page.",
 "plugin": {
  "slug": "litespeed-cache",
  "name": "LiteSpeed Cache",
  "full_name": "LiteSpeed Cache",
  "wordpress_org": "https://wordpress.org/plugins/litespeed-cache/",
  "advisories_url": "https://wpsec.com/vuln/plugin/litespeed-cache/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/litespeed-cache"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "7.6",
    "from_inclusive": true,
    "to": "7.9.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 7.6 before 7.9.2"
  ]
 },
 "introduced_in": "7.6",
 "fixed_in": "7.9.2",
 "remediation": "Update to 7.9.2 or later.",
 "fix_released": "2026-10-20T18:08:55+00:00",
 "published": "2026-10-21T18:42:23+00:00",
 "updated": "2026-10-21T12:33:12.120287+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1394/",
  "https://plugins.svn.wordpress.org/litespeed-cache/tags/7.9.2/",
  "https://wordpress.org/plugins/litespeed-cache/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/litespeed-cache",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-21"
 }
}