Description

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted `<img>` tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip `width` and `height` attributes from images when the "Lazy Load Images" and "Add Missing Sizes" features are enabled. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-28T05:16:42.200Z",
  "pubdate": "2026-08-28T05:16:42.200Z",
  "executiveSummary": "The LiteSpeed Cache plugin for WordPress is vulnerable to a critical Stored Cross-Site Scripting (XSS) security flaw affecting all versions up to, and including, 7.7. This vulnerability allows authenticated threat actors with Author-level privileges or higher to inject malicious JavaScript payloads directly into WordPress pages and posts. The security gap arises during the optimization phase, specifically when the plugin's 'Lazy Load Images' and 'Add Missing Sizes' features are enabled. A structural deficiency in the regular expression used to sanitize and strip image attributes fails to neutralize crafted HTML elements.\nConsequently, the injected malicious code is stored persistently within the application database and cached frontend pages. When an administrative user or general site visitor accesses the compromised page, the browser interprets and executes the arbitrary script in the context of their active session. This capability presents severe security implications, including session hijacking, unauthorized configuration changes, and potential administrative account takeover, bypassing standard access controls and compromising the overall integrity of the WordPress site.",
  "technicalDetails": "The root cause of this Stored Cross-Site Scripting vulnerability lies in the input processing and optimization engine of the LiteSpeed Cache plugin. When the 'Lazy Load Images' and 'Add Missing Sizes' features are active, the plugin parses post HTML and executes a regular expression routine designed to strip existing 'width' and 'height' attributes from `<img>` tags before generating optimized placeholders. However, this regular expression is flawed and fails to account for non-standard configurations, nested quotes, or specifically structured attributes within the HTML image tags.\nAn authenticated attacker with privileges to draft or edit posts (Author-level or higher) can exploit this flaw by constructing an `<img>` tag containing standard dimension parameters coupled with malicious event handlers, such as 'onerror', 'onload', or 'onmouseover'. A sample conceptual payload may look like: `<img src=\"x\" onerror=\"[malicious_javascript]\" width=\"1\" height=\"1\">`. During post submission, WordPress's core sanitization may allow the tag, and upon subsequent page rendering, the LiteSpeed Cache plugin attempts to parse and modify the tag.\nBecause of the flawed regular expression parsing logic, the plugin strips the targeted dimension attributes but fails to identify or strip the adjacent malicious script attributes, leaving them fully intact in the final cached HTML output. This cached output is persistently served to all users visiting the affected page. When a high-privilege user, such as a site Administrator, views the compromised page, their web browser executes the embedded JavaScript automatically under their session context. This execution bypasses the Same-Origin Policy (SOP), allowing the script to perform administrative actions on behalf of the victim, such as creating rogue administrative users, injecting backdoors, or redirecting traffic to external malicious domains."
}