Live › vulnerability › CVE-2026-113500
Go to dashboardThe LiteSpeed Cache plugin before 7.9.2 has an HTML optimization routine that is not limited to stylesheet content, and it can remove the closing quote of an attribute in rendered pages. Combined with unescaped comment author output, an unauthenticated commenter can inject event-handler attributes that run JavaScript in any visitor's browser, including a logged-in administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the LiteSpeed Cache WordPress plugin before 7.9.2 with HTML optimization enabled, where published comments are shown on front-end pages. Sites that do not use this plugin, or run a version at or above 7.9.2, are not affected. Sites that disable published-comment display or the optimization feature are less exposed.
No product ranges from the sources yet.
wp plugin get litespeed-cache --field=version7.9.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-113500")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.