CVE-2026-113499: LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting

Q: Which sites are exposed to exploitation?

Sites using LiteSpeed Cache versions earlier than 7.9.2 are exposed when the affected CDN inline CSS rewriting option is enabled. Exploitation also depends on attacker-controlled comments being published and a visitor loading an affected front-end page.

Q: What does an attacker need to exploit this issue?

The attacker does not need to be authenticated, but needs a comment they control to be published. They can then inject attributes that execute JavaScript when another user views the affected front-end page.

Q: Are administrators at risk?

Yes. A logged-in administrator can be affected if they visit a front-end page containing the published malicious comment while the affected option is enabled.

Q: What can be done if upgrading is not immediately possible?

Disable the affected CDN inline CSS rewriting option. Also prevent untrusted comments from being published until the plugin can be updated to version 7.9.2 or later.

Published Oct 23, 2026

Updated

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.

Affected Software

1 affected component

LiteSpeed LiteSpeed Cache<7.9.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade LiteSpeed Cache to a version that resolves this vulnerability.
Fixed in 7.9.2

Event History

Oct 23, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which sites are exposed to exploitation?

Sites using LiteSpeed Cache versions earlier than 7.9.2 are exposed when the affected CDN inline CSS rewriting option is enabled. Exploitation also depends on attacker-controlled comments being published and a visitor loading an affected front-end page.

What does an attacker need to exploit this issue?

The attacker does not need to be authenticated, but needs a comment they control to be published. They can then inject attributes that execute JavaScript when another user views the affected front-end page.

Are administrators at risk?

Yes. A logged-in administrator can be affected if they visit a front-end page containing the published malicious comment while the affected option is enabled.

What can be done if upgrading is not immediately possible?

Disable the affected CDN inline CSS rewriting option. Also prevent untrusted comments from being published until the plugin can be updated to version 7.9.2 or later.

CVE-2026-113499: LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting

Affected Software

Remediation

Event History

Frequently Asked Questions

Which sites are exposed to exploitation?

What does an attacker need to exploit this issue?

Are administrators at risk?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to exploitation?

What does an attacker need to exploit this issue?

Are administrators at risk?

What can be done if upgrading is not immediately possible?