CVE-2026-113500
UnknownSummary
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page. Combined with unescaped comment author output, this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator.
Risk Assessment
An XSS attack targeting an administrator and other visitors is possible, potentially leading to session hijacking and site compromise. It requires the optimization enabled and a published comment.
Recommendation
Update the LiteSpeed Cache plugin to version 7.9.2 or later. Consider disabling HTML optimization until updated.
Other vulnerabilities in LiteSpeed Cache WordPress plugin
See all- CVE-2026-113501Unknown
The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice. On sites in certain configurations, a low-privileged authenticated user (Subscriber) can dismiss administrative notices marked as non-dismissible, including a warning that sensitive files may be publicly accessible.
- CVE-2026-113499Unknown
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page. Combined with unescaped comment author output, this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator.
Original NVD description (English source)
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS