# LiteSpeed Cache <= 7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Attributes

- **ID:** WPSEC-2026-1394
- **Plugin:** LiteSpeed Cache (`litespeed-cache`), https://wordpress.org/plugins/litespeed-cache/
- **Affected versions:** from 7.6 before 7.9.2
- **Fixed in:** 7.9.2 (Update to 7.9.2 or later.)
- **Severity:** Medium 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/litespeed-cache
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1394/

## Description

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image tag attributes in all versions from 7.6 up to, and including, 7.9.1. This is due to insufficient output escaping when the plugin rebuilds viewport (VPI) image tags to add the fetchpriority and decoding attributes: parsed attribute values are re-emitted inside double quotes without escaping, so a single-quoted value containing double quotes breaks out of the attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page. Exploitation requires Viewport Images to be in use for that page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1394/
- https://plugins.svn.wordpress.org/litespeed-cache/tags/7.9.2/
- https://wordpress.org/plugins/litespeed-cache/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1394/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.