The LiteSpeed Cache WordPress plugin is vulnerable to a stored cross‑site scripting flaw in all versions up to 7.9.1 that allows an unauthenticated attacker to inject arbitrary JavaScript through the comment parameter. The flaw is caused by insufficient sanitization and output escaping during HTML minimization, so that injected scripts will execute whenever a user accesses a page that renders stored comment content in a raw‑text context such as a JSON‑LD script block.

LiteSpeed Technology’s LiteSpeed Cache plugin for WordPress, all releases up to and including 7.9.1, is affected. The vulnerability is triggered only when the HTML Minify option (O_OPTM_HTML_MIN) is enabled and a companion plugin renders comment content into a raw‑text context.

The CVSS score of 5.4 indicates moderate severity. No EPSS data is available and the issue is not listed in CISA KEV, implying limited evidence of exploitation so far. Exploitation requires the plugin’s HTML Minify feature to be active and a plugin that outputs stored comments in a raw‑text area; because it can be performed by unauthenticated users who can add a comment, the vulnerability presents a realistic risk for sites allowing public comments.