CVE-2026-3129: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in litespeedtech LiteSpeed Cache

CVE-2026-3129 is a stored cross-site scripting vulnerability in the LiteSpeed Cache WordPress plugin. It affects all versions up to and including 7.7. The flaw is caused by a faulty regular expression that fails to properly sanitize width and height attributes in <img> tags when the 'Lazy Load Images' and 'Add Missing Sizes' features are enabled. This allows authenticated attackers with Author-level privileges or above to inject malicious scripts that execute in the context of users visiting the injected pages. The CVSS 3.1 base score is 6.4, indicating a medium severity vulnerability with network attack vector, low attack complexity, and no user interaction required.

An attacker with Author-level access or higher can exploit this vulnerability to inject stored malicious scripts into pages. These scripts execute in the browsers of users who view the compromised pages, potentially leading to session hijacking, defacement, or other script-based attacks. The vulnerability does not affect availability but impacts confidentiality and integrity.

No official patch or remediation has been confirmed at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users and consider disabling the 'Lazy Load Images' and 'Add Missing Sizes' features if feasible to reduce exposure.