Security Update for LSCWP

We have a security update for LiteSpeed Cache for WordPress. Recently, we were made aware of a vulnerability in the LiteSpeed Cache for WordPress plugin. We patched it, in v7.9.2.

To protect your WordPress sites, please update to the latest version of the LSCache plugin immediately.

This Stored Cross-Site Scripting vulnerability, reported by the WordFence team, has been assigned CVE-2026-109215.

Impact

This vulnerability affects only sites where all of the following are true:

• Page Optimization > Media Settings > Lazy Load Images is set to ON
• Page Optimization > VPI > Viewport Images is set to ON
• The site lets users with at least a Subscriber role post content that can include images, such as replies on a bbPress forum. On sites with open user registration, anyone can get such an account.
• The page where that content appears has a Viewport Image defined, and the attacker can post an image with the same filename.

If these conditions are met, an attacker with such an account could get a script to run in the browser of anyone who visits an affected page. If the visitor is logged in as an administrator, the script would run with their permissions.

Actions

We recommend that every site upgrade to the plugin version 7.9.2 or higher to patch this vulnerability.

Timeline

• October 12, 2026: WordFence alerted us to the issue.
• October 19, 2026: We patched the issue and released v7.9.2 to the WordPress repository
• October 23, 2026: We added v7.9.2 to the list of stable releases in our control panel plugins

Conclusion

We thank WordFence for bringing this issue to our attention. This vulnerability has been patched, so if you are keeping your LiteSpeed Cache plugin up-to-date, there is nothing you need to do. If you have not updated in a while, please do so today.