CVE-2026-3129
6.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Summary
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted <img> tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add Missing Sizes" features are enabled. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| litespeedtech | LiteSpeed Cache | 0 <= 7.7 | affected |
Weaknesses
- CWE-79: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c107674d-173f-49cf-b329-e7bffaee841d?source=cve
- https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/media.cls.php#L761
- https://plugins.trac.wordpress.org/changeset/3473912/
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.