Stored XSS in LiteSpeed Cache WordPress Plugin

Executive Summary

The LiteSpeed Cache plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability in versions up to 7.9.1. It occurs due to insufficient input sanitization and output escaping in the 'bbp_reply_content' parameter. Authenticated attackers with subscriber-level access or higher can inject malicious scripts into pages. Exploitation requires an administrator to enable Viewport Images (VPI) and set a VPI filename matching an attacker-controlled image embedded in user-generated content, such as a bbPress topic.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into your WordPress site. If exploited, these scripts can execute whenever a user visits the infected page, potentially stealing user data, session cookies, or performing actions on behalf of users. It requires low-privilege access but can lead to broader site compromise if an administrator enables specific features like VPI.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. If exploited, it may result in data breaches, triggering compliance violations, legal penalties, and reputational damage for organizations handling sensitive user data.

Useful 0 Not Useful 0

Mitigation Strategies

Update the LiteSpeed Cache plugin to version 7.9.2-b10 or later to address the input sanitization flaw in the VPI feature.

Disable the Viewport Images (VPI) feature if not required, as it is a prerequisite for exploitation.

Review user roles with subscriber-level access or higher to ensure they cannot post untrusted content.

Useful 0 Not Useful 0