CVE-2026-109215: LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbpreplycontent' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled Viewport Images (VPI) and configured a VPI filename that matches an image the attacker can embed in user-generated content — such as a bbPress topic where Subscriber-level Participants are permitted to post replies containing raw img tags.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable Viewport Images (VPI), which is required for exploitation.
LiteSpeed Cache for WordPress Viewport Images (VPI) = disabled
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Exposure requires LiteSpeed Cache version 7.9.1 or earlier, Viewport Images (VPI) enabled, and a configured VPI filename that matches an image an attacker can embed in user-generated content. A relevant posting path must also allow subscriber-level or higher users to submit content containing raw img tags, such as bbPress replies where Participants can post them.
What level of access does an attacker need?
An attacker must be authenticated with Subscriber-level access or above. They also need to be able to place a matching image reference in user-generated content through an available posting feature.
What happens after successful exploitation?
The attacker can store arbitrary script in an affected page. That script executes in the browser whenever a user accesses the injected page.
What can be done while an update is unavailable?
Disable Viewport Images (VPI), or ensure configured VPI filenames cannot match images that untrusted users can embed. Restrict or disable raw img tags in user-generated posting areas available to Subscriber-level users.