LiteSpeed Cache CVE-2026-109215

Exploitation is gated by several concrete, non-default prerequisites that significantly limit realistic risk: (1) an administrator must have enabled the Viewport Images (VPI) optimization feature in LiteSpeed Cache; (2) the admin must have configured a VPI filename that matches an image the attacker can embed in user-generated content; and (3) the site must accept raw img tags in attacker-reachable content - the described vector is bbPress with Subscriber-level Participants permitted to post replies via the 'bbp_reply_content' parameter. Authentication is required: the CVSS vector shows PR:L, i.e., subscriber-level access and above. The payload fires only when another user subsequently views the injected page. Absent any of the VPI/bbPress configuration conditions, the stored XSS path is not reachable.

This is a legitimately lower-priority issue despite the network attack vector, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, C:L/I:L/A:N) scores 6.4 Medium, reflecting a stored XSS that requires only subscriber-level authentication (PR:L) and crosses the privilege scope (S:C) to affect other users. However, the CVSS vector materially understates the real-world barrier: the AC:L rating ignores the stacked, non-default prerequisites the description spells out - an administrator must have enabled the Viewport Images (VPI) feature AND configured a VPI filename that happens to match an image the attacker can embed, AND the site must run bbPress with Subscriber-level Participants allowed to post replies containing raw img tags. These are environmental conditions outside the attacker's control, which is why the independent assessment below raises complexity to AC:H. No EPSS score, SSVC decision breakdown, or KEV listing is provided in the input; the only prioritization signal is the vuln.today 'this_month' label, which matches a Medium, config-dependent XSS rather than an emergency. There is no exploitation signal: not in CISA KEV, and no public exploit identified at time of analysis - the references are a Wordfence advisory, WordPress trac source lines, and the vendor fix commit, none of which is a working PoC. Net: a real but conditional issue appropriate for routine monthly patching, not an urgent out-of-band response.

On a WordPress site running LiteSpeed Cache ≤7.9.1 where an admin has enabled Viewport Images (VPI) and set a VPI filename matching an embeddable image, a Subscriber-level bbPress participant posts a forum reply containing a crafted raw img tag with malicious attributes. When VPI rebuilds the image markup it reflects the attacker-controlled attribute names/values without escaping, so the stored script executes in the browser of any user who later views the injected page. No public exploit was identified at time of analysis.