Stored Cross-Site Scripting in LiteSpeed Cache Plugin for WordPress

CVE-2026-3129

What is CVE-2026-3129?

The LiteSpeed Cache plugin for WordPress is susceptible to Stored Cross-Site Scripting due to a vulnerability in its handling of <img> tag attributes. This flaw arises from a problematic regular expression used to filter width and height attributes when the 'Lazy Load Images' and 'Add Missing Sizes' features are activated. Authenticated attackers with Author-level access and higher can exploit this vulnerability, allowing them to inject arbitrary web scripts into pages. These scripts are executed whenever a user accesses a compromised page, posing significant security risks to visitors of the affected site.

References