CVE-2026-3129

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted <img> tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add Missing Sizes" features are enabled. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.