CVE-2026-109215 in LiteSpeed Cache Plugin
Summary
by MITRE • 10/29/2026
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled Viewport Images (VPI) and configured a VPI filename that matches an image the attacker can embed in user-generated content — such as a bbPress topic where Subscriber-level Participants are permitted to post replies containing raw img tags.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The LiteSpeed Cache plugin for WordPress, specifically versions up through 7.9.1, contains a critical stored cross-site scripting vulnerability that stems from insufficient input sanitization and output escaping mechanisms within the application logic. This flaw is primarily associated with the handling of the bbp_reply_content parameter, which processes user-generated content in forums powered by bbPress integration. The core technical deficiency lies in the failure to properly validate or encode special characters before storing them in the database and subsequently rendering them back into HTML contexts without adequate protection against script injection. This lack of robust sanitization allows malicious actors to embed executable JavaScript code directly within forum replies, which are then served to other users as part of legitimate page content.
Exploitation of this vulnerability requires a specific set of conditions that narrow the attack surface but do not eliminate the risk entirely. An attacker must possess at least subscriber-level access privileges on the WordPress installation, allowing them to post in public forums or topics where raw HTML tags are permitted. Crucially, the administrator must have enabled Viewport Images functionality and configured a VPI filename pattern that coincidentally matches an image source controlled by the attacker. By embedding a malicious img tag with a crafted src attribute within a bbPress reply, the attacker can trigger the execution of arbitrary web scripts whenever another user views the page containing this content. This scenario highlights how configuration choices in caching plugins can inadvertently expand the attack surface for authenticated users who might otherwise have limited capabilities.
The operational impact of this stored cross-site scripting vulnerability is significant because it enables persistent attacks that do not require repeated exploitation attempts against individual victims. Once a malicious reply is posted, every user who accesses the affected page becomes a potential victim, leading to widespread compromise if multiple users view the content. Attackers can leverage this access to steal session cookies, hijack administrative sessions, perform actions on behalf of legitimate users, or redirect visitors to phishing sites designed to harvest credentials. The persistence of the payload means that even after the initial post is made, the threat remains active until the malicious content is manually removed from the database by an administrator, creating a prolonged window of exposure for all site visitors.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored XSS where malicious scripts are permanently stored in target servers and subsequently retrieved by victims. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques under T1059 Command and Control or potentially T1189 Drive-by Client Compromise if used for malware delivery, though more accurately it fits within initial access vectors like T1133 External Remote Services when considering how authenticated users interact with the system. The reliance on specific configuration settings such as Viewport Images demonstrates how feature-specific implementations can introduce unique attack paths that are not covered by generic security controls.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. Administrators should immediately upgrade to a patched version of LiteSpeed Cache where this input validation issue has been resolved, ensuring that all special characters in user-generated content are properly encoded before being rendered in HTML contexts. Additionally, organizations should review their bbPress configurations to restrict the types of HTML tags allowed in forum posts, preferably using strict allowlists rather than broad permissions for raw img tags. Implementing Content Security Policy headers can also provide an additional layer of defense by restricting the sources from which scripts can be loaded, thereby mitigating the impact even if a script injection attempt succeeds. Regular security audits and penetration testing focused on user input handling in community-driven platforms are essential to identify similar vulnerabilities before they can be exploited in production environments.