Do Son 
TL;DR
LiteSpeed Cache 7.9.2, released October 20, 2026, fixes three LiteSpeed Cache vulnerabilities disclosed by WPScan on October 23. Two flaws let unauthenticated commenters plant stored XSS that runs in an administrator’s browser. The plugin has more than 7 million active installations, according to plugin trackers.
- Product: Unknown LiteSpeed Cache
- Vulnerabilities: 3 flaws (CVE-2026-113499, CVE-2026-113500, CVE-2026-113501)
- Highest severity: 7.5 (High · CVSSv3)
- Worst impact: < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting
- Status: No confirmed exploitation yet; patches available
- Action: Update to 7.9.2 now
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-113499 | 7.5 | CWE-79 | 7.9.2 | Not exploited |
| CVE-2026-113500 | 7.5 | CWE-79 | 7.9.2 | Not exploited |
| CVE-2026-113501 | 3.1 | CWE-862 | 7.9.2 | Not exploited |
Why It Matters
LiteSpeed Cache is one of the most widely used WordPress performance plugins. A script that runs in an admin’s browser can act with that admin’s rights. That can mean new admin accounts or a full site takeover. Given the install base, these LiteSpeed Cache vulnerabilities reach a very large number of sites.
How the Attacks Work
Stored XSS through comments
CVE-2026-113499 and CVE-2026-113500 share one root cause. An HTML optimization routine is not limited to stylesheet content, so it can strip the quote that closes an attribute. Combined with unescaped comment author output, a published comment can then “inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator.”
Two conditions limit the risk. First, the attacker’s comment must be published. Second, the attack works only “while the optimization is enabled.” Full details sit in the WPScan advisory for CVE-2026-113499 and the WPScan entry for CVE-2026-113500.
Hidden security warnings
The third flaw, CVE-2026-113501, lacks a capability check. According to the WPScan advisory for CVE-2026-113501, a Subscriber can dismiss notices marked non-dismissible, “including a warning that sensitive files may be publicly accessible.”
Exploitation status
No source reports exploitation of these LiteSpeed Cache vulnerabilities in the wild. No CVSS scores are published yet. The PoC will be published on November 22, 2026, to give users the time to update.
Affected Versions
All LiteSpeed Cache versions before 7.9.2 are affected.
Patch and Mitigation Steps
- Update the LiteSpeed Cache plugin to 7.9.2 or later.
- Hold new comments for moderation until you update.
- Review recent comments and admin accounts for anything unusual.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
