LiteSpeed image-size processing permits Author-level stored XSS
LiteSpeed Cache through 7.7 uses a flawed regular expression to remove width and height from img tags when Lazy Load Images and Add Missing Sizes are enabled. An Author can craft image attributes that become stored script and execute when a visitor opens the post.
- Component
- LiteSpeed Cache
- Plugin slug
litespeed-cache- Affected
- <= 7.7
- Safe version
- See mitigation notes
- Published
- Aug 28, 2026
This CVE was published Aug 28, 2026 and is one of 23 known issues for this plugin.
Update, patch or deactivate.
No fixed release is confirmed. Update LiteSpeed Cache when a release after 7.7 is confirmed to fix the issue; until then, disable the affected image features or restrict Author publishing when warranted and inspect untrusted img attributes.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted `<img>` tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip `width` and `height` attributes from images when the "Lazy Load Images" and "Add Missing Sizes" features are enabled. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N