CVE-2026-113501
UnknownSummary
The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice. On sites in certain configurations, a low-privileged authenticated user (Subscriber) can dismiss administrative notices marked as non-dismissible, including a warning that sensitive files may be publicly accessible.
Risk Assessment
A low-privileged user can hide important security warnings from the administrator, delaying response to threats. It does not directly lead to code execution.
Recommendation
Update the LiteSpeed Cache plugin to version 7.9.2 or later. Verify that sensitive files are not publicly accessible.
Other vulnerabilities in LiteSpeed Cache WordPress plugin
See all- CVE-2026-113500Unknown
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page. Combined with unescaped comment author output, this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator.
- CVE-2026-113499Unknown
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page. Combined with unescaped comment author output, this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator.
Original NVD description (English source)
The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS