CVE-2026-109215

Name of the Vulnerable Software and Affected Versions LiteSpeed Cache versions prior to 7.9.2

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the bbp reply content parameter, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. Exploitation is possible if an administrator has enabled Viewport Images (VPI) and configured a VPI filename that matches an image the attacker can embed in user-generated content, such as bbPress topics where participants can post replies containing raw img tags.

Recommendations Update LiteSpeed Cache to version 7.9.2 or later. As a temporary mitigation, disable the Viewport Images (VPI) feature or restrict the use of the bbp reply content parameter in user-generated content.