Live › vulnerability › CVE-2026-113499
Go to dashboardBefore version 7.9.2, LiteSpeed Cache strips a closing quote from HTML attributes outside stylesheets, so a published comment can inject attributes that run JavaScript. The script runs in the browser of any visitor, including a logged-in administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running LiteSpeed Cache before 7.9.2 with the affected HTML rewriting option enabled and comments that are published without escaping in the comment author field. Sites that do not run the plugin, or that run a patched version, are not exposed. The sources do not say which option is affected.
No product ranges from the sources yet.
wp plugin get litespeed-cache --field=version7.9.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-113499")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.