CVE-2026-113499
UnknownSummary
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page. Combined with unescaped comment author output, this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator.
Risk Assessment
An XSS attack targeting an administrator and other visitors is possible, potentially leading to session hijacking and site compromise. It requires the affected option enabled and a published comment.
Recommendation
Update the LiteSpeed Cache plugin to version 7.9.2 or later. Consider disabling the affected option until updated.
Other vulnerabilities in LiteSpeed Cache WordPress plugin
See all- CVE-2026-113501Unknown
The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice. On sites in certain configurations, a low-privileged authenticated user (Subscriber) can dismiss administrative notices marked as non-dismissible, including a warning that sensitive files may be publicly accessible.
- CVE-2026-113500Unknown
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page. Combined with unescaped comment author output, this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator.
Original NVD description (English source)
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS