CVE-2026-3129

Deferred Deferred - Pending Action

Stored XSS in LiteSpeed Cache WordPress Plugin

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: Wordfence

Description

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted `<img>` tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip `width` and `height` attributes from images when the "Lazy Load Images" and "Add Missing Sizes" features are enabled. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-3129

EUVD

EUVD-2026-67407

Affected Vendors & Products

Vendor	Product	Version / Range
lwies	litepeed_cache	to 7.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The LiteSpeed Cache plugin for WordPress has a flaw in its regular expression that fails to properly remove width and height attributes from image tags when certain features are enabled. This allows attackers with Author-level access or higher to inject malicious scripts into web pages via crafted image tags.

Detection Guidance

Check if the LiteSpeed Cache plugin is installed and verify its version. If it is version 7.7 or lower, the system is vulnerable. Inspect WordPress sites for unauthorized script injections in image attributes.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary web scripts on your site whenever users visit infected pages. This could lead to unauthorized actions, data theft, or defacement of your WordPress site.

Compliance Impact

This vulnerability allows authenticated attackers to inject malicious scripts into WordPress pages via stored XSS. This could lead to unauthorized data access, modification, or exfiltration, potentially violating GDPR (data protection) and HIPAA (health data privacy) compliance if sensitive user or patient information is compromised.

Mitigation Strategies

Update the LiteSpeed Cache plugin to the latest version. Disable the 'Lazy Load Images' and 'Add Missing Sizes' features if an update is not immediately available. Review and remove any suspicious scripts or attributes from posts and pages.

Hi! I’m here to help you understand CVE-2026-3129. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70