The LiteSpeed Cache plugin for WordPress contains a stored cross‑site scripting flaw that accepts unsanitized content from the bbp_reply_content field, allowing an attacker who can submit bbPress replies to inject arbitrary script tags that will be re‑serialized by the Viewport Images (VPI) subsystem. When an authenticated user with subscriber‑level or higher access posts a reply containing a raw img tag that references a VPI‑configured filename, the malicious payload is saved to the database and subsequently delivered to any website visitor who views the reply. The injected scripts run in the context of the site, potentially compromising user credentials, session data, or defacing pages, thereby creating a significant threat to confidentiality and integrity on sites using this plugin.

The vulnerability affects the LiteSpeed Cache plugin for WordPress from all versions up to and including 7.9.1, a product maintained by LiteSpeed Technologies. Users who have installed versions 7.9.1 or older are exposed, regardless of WordPress core version, and any site that has enabled the library’s Viewport Images feature for subscriber‑level content.

The flaw carries a CVSS score of 6.4, indicating medium severity, and is not listed in CISA’s KEV catalog. No EPSS value is provided, but the requirement for authenticated access and a specific VPI image configuration suggests a moderate exploitation likelihood in environments where many subscribers exist or where VPI is enabled. Attackers can leverage this vector to execute scripts on the browsers of any user who views the infected reply, so the risk is heightened for sites with active bbPress forums or similar user‑generated content.