CVE-2026-116763: LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the HTML Minify option (OOPTMHTMLMIN) is enabled and a companion plugin renders stored comment content into a raw-text context such as a JSON-LD script block on the same page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the HTML Minify option (O_OPTM_HTML_MIN), because the vulnerability is exploitable when HTML Minify is enabled.
LiteSpeed Cache for WordPress O_OPTM_HTML_MIN = disabled
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites using LiteSpeed Cache version 7.9.1 or earlier are exposed only if HTML Minify (O_OPTM_HTML_MIN) is enabled and another plugin renders stored comment content in a raw-text context, such as a JSON-LD script block, on the same page.
Does an attacker need an account or user interaction to inject the payload?
No account or prior privileges are required to inject the stored script through the comment parameter. The payload executes later when a user visits an affected injected page.
What can be done if updating is not immediately possible?
Disable the HTML Minify option. Also prevent or remove companion-plugin output that places stored comment content into raw-text contexts such as JSON-LD script blocks.