CVE-2026-109215

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled Viewport Images (VPI) and configured a VPI filename that matches an image the attacker can embed in user-generated content — such as a bbPress topic where Subscriber-level Participants are permitted to post replies containing raw img tags.

• CWE-79

• https://github.com/litespeedtech/lscache_wp/commit/0fc5f9ad69a138b8ee1fe2d07a5e9ac2574e1eb0
• https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/src/media.cls.php#L936
• https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/src/media.cls.php#L968
• https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/src/utility.cls.php#L299
• https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.2/src/media.cls.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf9b130-bb1e-43fc-b5c9-337646b8976e?source=cve

Published

Oct 29, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-109206LogicalDOC Community Edition through 9.3 contains a username…5.3
• CVE-2026-109207The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, N…7.2
• CVE-2026-109208The LearnPress – WordPress LMS Plugin for Create and Sell On…7.2
• CVE-2026-109209The All-in-One Video Gallery – Video Player & Galleries for …6.4
• CVE-2026-10921Integer overflow in Dawn in Google Chrome prior to 149.0.782…8.3
• CVE-2026-109213Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-109216The Meta Box – A Framework for Dynamic Websites plugin for W…4.9
• CVE-2026-109217The PDF Invoices & Packing Slips for WooCommerce plugin for …5.3
• CVE-2026-109218The Contact Manager plugin for WordPress is vulnerable to Ar…9.8
• CVE-2026-109219The Mang Board plugin for WordPress is vulnerable to Arbitra…9.8
• CVE-2026-10922Insufficient validation of untrusted input in DevTools in Go…8.8
• CVE-2026-109220The PDF Invoice for WooCommerce + Drag and Drop Template Bui…9.8