CVE-2026-3129: LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted <img> tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add Missing Sizes" features are enabled. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LiteSpeed Cache (WordPress plugin)to a version that resolves this vulnerability.Fixed in 7.7 - Configuration
Disable the "Lazy Load Images" feature to avoid the vulnerable width/height attribute stripping behavior (vulnerable in versions up to and including 7.7 when enabled).
LiteSpeed Cache (WordPress plugin) Lazy Load Images = disable - Configuration
Disable the "Add Missing Sizes" feature to avoid the vulnerable width/height attribute stripping behavior (vulnerable in versions up to and including 7.7 when enabled).
LiteSpeed Cache (WordPress plugin) Add Missing Sizes = disable - Compensating control
Because the issue requires authenticated attackers with Author-level access and above, restrict/limit who can publish or edit posts (Author and above) in WordPress to trusted users to reduce the likelihood of stored XSS injection.
Event History
Frequently Asked Questions
Are both image-related features required for exposure?
The vulnerable attribute-stripping logic is used when both “Lazy Load Images” and “Add Missing Sizes” are enabled. The provided information does not establish exposure when either feature is disabled.
What level of access does an attacker need?
An attacker must be authenticated to WordPress with an Author role or a higher-privileged role. No separate user interaction by the attacker is required.
When would injected code run?
The stored script runs whenever another user accesses a page containing the attacker’s crafted image tag. This can affect users who view the injected page, including higher-privileged users.
Which deployments should be prioritized for remediation?
Prioritize LiteSpeed Cache installations running version 7.7 or earlier where both affected features are enabled and Author-or-higher accounts can create or modify page content.