CyberRota Analysis
AI-GeneratedThe LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to a flawed regular expression that fails to properly sanitize `<img>` tag attributes when specific features are enabled. This vulnerability allows authenticated attackers with Author-level access or higher to inject malicious scripts into pages, which can execute in the context of users visiting those pages. WordPress site administrators, particularly those using the LiteSpeed Cache plugin, should prioritize this issue to mitigate potential exploitation.
Original NVD Description
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted `<img>` tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip `width` and `height` attributes from images when the "Lazy Load Images" and "Add Missing Sizes" features are enabled. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.