CVE-2026-3129: LiteSpeed Cache WordPress Plugin XSS Vulnerability

CVE-2026-3129 Overview

CVE-2026-3129 is a Stored Cross-Site Scripting (XSS) vulnerability in the LiteSpeed Cache plugin for WordPress. The flaw affects all versions up to and including 7.7. It stems from a flawed regular expression used to strip width and height attributes from <img> tags when the "Lazy Load Images" and "Add Missing Sizes" features are enabled.

Authenticated attackers with Author-level access or higher can inject arbitrary web scripts through crafted <img> attributes. The injected script executes in the browser of any user who accesses the affected page. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Author-level users can persist JavaScript payloads into published pages, enabling session theft, account takeover of higher-privileged users, and site defacement across all visitors.

Affected Products

LiteSpeed Cache plugin for WordPress, all versions up to and including 7.7
WordPress sites where the "Lazy Load Images" feature is enabled
WordPress sites where the "Add Missing Sizes" feature is enabled

Discovery Timeline

2026-08-27 - LiteSpeed Technologies publishes security update for LSCWP
2026-08-28 - CVE-2026-3129 published to the National Vulnerability Database (NVD)
2026-08-29 - Last updated in the NVD database

Technical Details for CVE-2026-3129

Vulnerability Analysis

The vulnerability resides in the LiteSpeed Cache plugin's media handling code, specifically within src/media.cls.php around line 761. When the "Lazy Load Images" and "Add Missing Sizes" features are enabled, the plugin parses <img> tags in rendered content to remove existing width and height attributes before recalculating and appending correct sizes.

The parsing relies on a regular expression rather than a DOM-aware HTML parser. Attackers can craft <img> attribute values that the regex fails to neutralize, allowing raw HTML and script content to survive the transformation and reach the browser as executable markup. The Cross-Site Scripting (XSS) payload is persisted because the modified content is stored in generated pages and served to every visitor.

Root Cause

The root cause is improper neutralization of user-controlled input during page generation, tracked as [CWE-79]. Regular expressions cannot reliably tokenize HTML attribute boundaries. Malformed or nested quoting inside a crafted <img> tag can bypass the strip logic and allow arbitrary attributes such as event handlers to remain intact in the output. Author-level accounts in WordPress can insert raw HTML into posts, which supplies the injection point.

Attack Vector

An authenticated attacker with Author privileges or higher publishes a post containing a specially crafted <img> tag. When a visitor loads the page and the LiteSpeed Cache media rewriter processes the markup, the flawed regex leaves attacker-controlled JavaScript in the DOM. The script executes in each visitor's browser session under the site's origin.

The attack vector is Network, requires low privileges, and no user interaction beyond page navigation. Impact spans confidentiality and integrity through cookie theft, session hijacking, and potential privilege escalation if an administrator views the page. See the Wordfence Vulnerability Analysis for additional technical context.

// No verified proof-of-concept code is published for CVE-2026-3129.
// See the WordPress Plugin Code Review reference for the vulnerable
// regex in src/media.cls.php around line 761.

Detection Methods for CVE-2026-3129

Indicators of Compromise

Posts or pages authored by non-administrator users containing <img> tags with unusual attribute quoting, embedded angle brackets, or event handler attributes such as onerror, onload, or onmouseover.
Unexpected outbound requests from visitor browsers to attacker-controlled domains after visiting content pages.
New or modified WordPress administrator accounts created shortly after visits by privileged users to a suspect page.

Detection Strategies

Review the LiteSpeed Cache plugin version in wp-content/plugins/litespeed-cache/ and flag any installation at version 7.7 or earlier with lazy-load features enabled.
Scan post and page content in the wp_posts table for <img> tags containing script keywords, JavaScript URI schemes, or on-event attributes.
Correlate WordPress audit logs for content creation by Author-level accounts with subsequent administrator session activity from unfamiliar IPs.

Monitoring Recommendations

Enable web server access logging and monitor for anomalous JavaScript-bearing responses from cached pages.
Deploy a Content Security Policy (CSP) with reporting to capture inline script violations originating from rendered posts.
Alert on modifications to files under wp-content/plugins/litespeed-cache/ and on changes to published post content by low-privileged authors.

How to Mitigate CVE-2026-3129

Immediate Actions Required

Update the LiteSpeed Cache plugin to the version released in the vendor changeset referenced in the security advisory.
Audit all WordPress accounts with Author privileges or higher and remove accounts that are inactive or unnecessary.
Review recently published or modified posts for <img> tags containing suspicious attributes and remove or sanitize them.

Patch Information

LiteSpeed Technologies released a fix documented in the LiteSpeed Technologies Security Update. The corresponding code change is available in the WordPress Changeset Update, which corrects the attribute-stripping logic in src/media.cls.php. All installations running LiteSpeed Cache 7.7 or earlier should upgrade immediately.

Workarounds

Disable the "Lazy Load Images" feature in the LiteSpeed Cache settings until the plugin is patched.
Disable the "Add Missing Sizes" feature under the plugin's media optimization settings.
Restrict content publication to Editor and Administrator roles by removing HTML posting privileges from Author accounts using a capability management plugin.

bash

# Verify installed LiteSpeed Cache plugin version on a WordPress host
wp plugin get litespeed-cache --field=version

# Update the plugin to the latest patched release
wp plugin update litespeed-cache

# Optionally disable the vulnerable features until patched
wp option patch update litespeed.conf media-lazy 0
wp option patch update litespeed.conf media-add_missing_sizes 0