Description
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.
Published: 2026-10-23
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an HTML optimization routine in the LiteSpeed Cache plugin that inadvertently strips the closing markup of an attribute, and because the comment author field is not escaped, an unauthenticated user can insert an event‑handler attribute containing JavaScript. This stored XSS can execute in the browsers of any visitor, including logged‑in administrators, allowing attackers to steal session data, modify page content, or otherwise subvert the user experience.

Affected Systems

LiteSpeed Cache for WordPress versions prior to 7.9.2 that have Font Display Optimization enabled are affected. Any installation accepting unescaped comment author input is vulnerable.

Risk and Exploitability

The issue is high‑severe, requiring no authentication beyond public comment posting and is widely exploitable where comments are publicly published and the optimization feature is active. The CVSS score of 7.5 indicates a high severity; EPSS data is not available and the flaw is not listed in the CISA KEV catalog. Attackers typically require only to submit a crafted comment to inject the payload.

Generated by OpenCVE AI on October 23, 2026 at 12:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update LiteSpeed Cache to version 7.9.2 or newer
  • If an upgrade is not immediately possible, temporarily disable Font Display Optimization until the patch is applied
  • Ensure that comment author fields are properly escaped or sanitized before rendering on the site

Generated by OpenCVE AI on October 23, 2026 at 12:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79

Fri, 23 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Description The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.
Title LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-23T10:46:03.416Z

Reserved: 2026-10-20T09:59:40.337Z

Link: CVE-2026-113500

cve-icon Vulnrichment

Updated: 2026-10-23T10:36:28.637Z

cve-icon NVD

Status : Deferred

Published: 2026-10-23T06:17:06.587

Modified: 2026-10-23T14:20:57.920

Link: CVE-2026-113500

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T12:30:11Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')