The LiteSpeed Cache WordPress plugin contains a stored cross‑site scripting flaw that allows attackers to inject scripts through comment content. The vulnerability is caused by insufficient input sanitization and output escaping, allowing an attacker to embed a payload consisting only of decimal numeric character references inside a permitted element such as <code>. When a comment containing such a payload is saved, the script is stored and subsequently rendered on pages that display the comment, leading to arbitrary script execution in the browsers of users who view that content.

All versions of the LiteSpeed Cache plugin up to and including 7.8.1 are affected. The issue was discovered in the plugin coded by litespeedtech and affects WordPress sites that use this plugin for caching and comment handling.

The flaw carries a CVSS score of 7.2, indicating a high severity impact. No EPSS score is publicly available and the vulnerability is not included in CISA’s KEV catalog. Exploitation requires that the WordPress site allows users with previously approved comments to write new comments and that the require_name_email setting is disabled. Attackers can deliver the payload via the comment form; the stored XSS then executes when any visitor loads an affected page, potentially allowing credential theft, defacement, or other malicious actions. Given the lack of a known public exploit but high CVSS, the risk remains high if the conditions are met.