CVE-2026-76579: LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter
The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the attacker supply a validly signed 'esi' value in the GET query string while submitting a separate attacker-controlled 'esi' payload as a POST body field, relying on PHP's default $REQUEST merge order to have the POST value take precedence at the point of execution.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must cause a user to perform an action such as clicking a crafted link. The request also needs a validly signed esi value in the GET query string and a separate attacker-controlled esi value in the POST body, with PHP's default $_REQUEST merge behavior allowing the POST value to take precedence.
Are unauthenticated attackers able to exploit it?
Yes. No authentication is required, but exploitation has a high attack-complexity requirement because the attacker must supply a validly signed GET esi value and induce user interaction.
Which installations are affected?
LiteSpeed Cache versions up to and including 7.9 are affected. The provided information does not state whether a particular non-default configuration is required.