Read the docs
TI-2026-82330 Aliases CVE-2026-109215GHSA-22hp-rp2j-wf97

Stored cross-site scripting in LiteSpeed Cache WordPress plugin

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The LiteSpeed Cache plugin for WordPress in all versions up to and including 7.9.1 contains a stored cross-site scripting flaw (CWE-79). Input submitted through the bbp_reply_content parameter is insufficiently sanitized and escaped, so injected scripts are stored and run when a user opens the affected page. An authenticated attacker with Subscriber-level access or above can exploit this when Viewport Images is enabled with a matching VPI filename.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled Viewport Images (VPI) and configured a VPI filename that matches an image the attacker can embed in user-generated content — such as a bbPress topic where Subscriber-level Participants are permitted to post replies containing raw img tags.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00334 26th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
litespeedtechLiteSpeed Cacheup to 7.9.1—No fix listedCNA
  • LiteSpeed Cache Vendorlitespeedtech Affected up to 7.9.1 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:*:*:*——litespeedtech
  • cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:*:*:* Versions — — ·litespeedtech

Remediation

The sources list no fixed version for LiteSpeed Cache.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-109215
  2. 2026-10-29 CISA SSVC decision points changed
  3. 2026-10-29 Priority changed: MEDIUM → LOW
  4. 2026-10-29 Alias added: GHSA-22hp-rp2j-wf97

References

Other 6

  • TI-2026-35606 LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to… KEVCVSS 4.0CRITICAL 10.0
  • TI-2026-39296 LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before… KEVCVSS 3.1HIGH 8.5
  • TI-2024-29589 WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-18601 WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-00030 Authenticated Remote Code Execution in OpenLiteSpeed Web Server CVSS 3.1HIGH 8.8
  • TI-2026-83023 Client certificate bypass over HTTP/3 in OpenLiteSpeed CVSS 4.0HIGH 8.2
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences