CVE-2026-113500: LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization

Q: Which sites are exposed to this issue?

Sites using LiteSpeed Cache versions earlier than 7.9.2 are exposed when the affected HTML optimization routine is enabled and attacker-controlled comments can be published.

Q: What does an attacker need to exploit it?

The attacker does not need to authenticate, but their comment must be published. Exploitation relies on unescaped comment-author output together with the enabled optimization behavior.

Q: Who could be affected if exploitation succeeds?

JavaScript can execute in the browser of visitors viewing affected front-end pages. This includes logged-in administrators who browse those pages.

Q: What can be done if an immediate update is not possible?

Disable the affected HTML optimization routine until LiteSpeed Cache can be updated to version 7.9.2 or later.

Q: How can I assess whether exploitation may already be possible?

Check whether the plugin version is earlier than 7.9.2, whether the relevant HTML optimization is enabled, and whether published comments from untrusted users appear on front-end pages.

Published Oct 23, 2026

Updated

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.

Affected Software

1 affected component

LiteSpeed LiteSpeed Cache<7.9.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade LiteSpeed Cache to a version that resolves this vulnerability.
Fixed in 7.9.2

Event History

Oct 23, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which sites are exposed to this issue?

Sites using LiteSpeed Cache versions earlier than 7.9.2 are exposed when the affected HTML optimization routine is enabled and attacker-controlled comments can be published.

What does an attacker need to exploit it?

The attacker does not need to authenticate, but their comment must be published. Exploitation relies on unescaped comment-author output together with the enabled optimization behavior.

Who could be affected if exploitation succeeds?

JavaScript can execute in the browser of visitors viewing affected front-end pages. This includes logged-in administrators who browse those pages.

What can be done if an immediate update is not possible?

Disable the affected HTML optimization routine until LiteSpeed Cache can be updated to version 7.9.2 or later.

How can I assess whether exploitation may already be possible?

Check whether the plugin version is earlier than 7.9.2, whether the relevant HTML optimization is enabled, and whether published comments from untrusted users appear on front-end pages.

CVE-2026-113500: LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization

Affected Software

Remediation

Event History

Frequently Asked Questions

Which sites are exposed to this issue?

What does an attacker need to exploit it?

Who could be affected if exploitation succeeds?

What can be done if an immediate update is not possible?

How can I assess whether exploitation may already be possible?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to this issue?

What does an attacker need to exploit it?

Who could be affected if exploitation succeeds?

What can be done if an immediate update is not possible?

How can I assess whether exploitation may already be possible?