The flaw stems from an HTML rewriting routine in LiteSpeed Cache that is not restricted to stylesheet content. During CDN delivery, the routine removes a quote that terminates an attribute, allowing a malicious fragment from an unescaped comment author field to inject an attribute that executes JavaScript. This stored XSS can run on any front‑end page viewed by visitors, including logged‑in administrators, thereby compromising the confidentiality and integrity of user sessions and facilitating session hijacking.

The vulnerability affects LiteSpeed Cache WordPress plugin versions older than 7.9.2. It is reported for the entire product line delivered by LiteSpeed and no other vendors or products are cited.

The description identifies an unauthenticated stored XSS, which is rated a CVSS score of 7.5, indicating a high‑severity flaw. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker needs only to post a comment containing the malicious payload; any site visitor will trigger the script because the comment is publicly rendered. The exploit is purely client‑side and requires no special privileges, making it potentially widely exploitable.