{"id":"CVE-2026-113500","kind":"vulnerability","aliases":["CVE-2026-113500"],"related":[],"title":"LiteSpeed Cache WordPress plugin: comment injection runs JavaScript in visitor browsers","description":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.","summary":"The LiteSpeed Cache plugin before 7.9.2 has an HTML optimization routine that is not limited to stylesheet content, and it can remove the closing quote of an attribute in rendered pages. Combined with unescaped comment author output, an unauthenticated commenter can inject event-handler attributes that run JavaScript in any visitor's browser, including a logged-in administrator.","severity":"high","cvss":7.5,"epss":0.00187,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["litespeed-cache","package","self-hosted","wordpress"],"not_affected_if":["html-optimization-disabled","plugin-at-7.9.2-or-later"],"how_to_check":"- Check the installed LiteSpeed Cache plugin version in the WordPress admin under Plugins, or with `wp plugin get litespeed-cache --field=version`\n- Check whether HTML optimization is enabled in the LiteSpeed Cache settings (unknown if the sources give the exact option name)","fix":"- Update the LiteSpeed Cache plugin to `7.9.2` or later\n- Until updated, disable the HTML optimization feature in LiteSpeed Cache settings (unknown exact menu path from sources)","status":"open","published_at":"2026-10-23T06:17:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:14:59+00:00","updated_at":"2026-10-25T03:14:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:14:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update the LiteSpeed Cache plugin to `7.9.2` or later\n- Until updated, disable the HTML optimization feature in LiteSpeed Cache settings (unknown exact menu path from sources)","reach":"internet","title":"LiteSpeed Cache WordPress plugin: comment injection runs JavaScript in visitor browsers","impact":"high","summary":"The LiteSpeed Cache plugin before 7.9.2 has an HTML optimization routine that is not limited to stylesheet content, and it can remove the closing quote of an attribute in rendered pages. Combined with unescaped comment author output, an unauthenticated commenter can inject event-handler attributes that run JavaScript in any visitor's browser, including a logged-in administrator.","category":"package","nicknames":[],"who_cares":["wordpress","litespeed-cache","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs JavaScript in administrator browsers, enabling account takeover.","analyst_note":"Confirm the exact HTML optimization setting name and whether comment moderation mitigates the injection, using the NVD entry for CVE-2026-113500.","how_to_check":"- Check the installed LiteSpeed Cache plugin version in the WordPress admin under Plugins, or with `wp plugin get litespeed-cache --field=version`\n- Check whether HTML optimization is enabled in the LiteSpeed Cache settings (unknown if the sources give the exact option name)","needs_analyst":true,"not_affected_if":["plugin-at-7.9.2-or-later","html-optimization-disabled"],"who_is_affected":"Sites running the LiteSpeed Cache WordPress plugin before 7.9.2 with HTML optimization enabled, where published comments are shown on front-end pages. Sites that do not use this plugin, or run a version at or above 7.9.2, are not affected. Sites that disable published-comment display or the optimization feature are less exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":3421,"output_tokens":723,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113500':14A,17A '-2026':13A,16A '7.9.2':31B,92C 'administr':85B,154C 'allow':127C 'attribut':53B,71B,114C,139C 'author':61B,124C 'browser':11A,79B,145C 'cach':2A,20B,28B,88C 'close':49B,112C 'combin':57B,120C 'comment':5A,60B,65B,123C,131C 'content':43B,104C 'cve':12A,15A 'delet':108C 'enabl':164C 'end':158C 'event':69B,137C 'event-handl':68B,136C 'front':157C 'front-end':156C 'handler':70B,138C 'host':24B 'html':34B,99C 'includ':80B,149C 'inject':6A,67B,135C 'javascript':8A,74B,142C 'limit':40B,95C 'litespe':1A,19B,27B,87C 'litespeed-cach':18B 'log':83B,152C 'logged-in':82B,151C 'markup':110C 'one':96C 'optim':35B,100C,162C 'output':62B,125C 'packag':21B 'page':56B,118C,159C 'plugin':4A,29B,90C 'publish':133C 'quot':50B 'remov':47B 'render':55B,117C 'routin':36B,101C 'run':7A,73B,141C 'self':23B 'self-host':22B 'stylesheet':42B,103C 'unauthent':64B,128C 'unescap':59B,122C 'user':129C 'view':155C 'visitor':10A,77B,148C 'whose':130C 'wordpress':3A,25B,89C","nicknames":[],"mitigations":[],"who_affected":"Sites running the LiteSpeed Cache WordPress plugin before 7.9.2 with HTML optimization enabled, where published comments are shown on front-end pages. Sites that do not use this plugin, or run a version at or above 7.9.2, are not affected. Sites that disable published-comment display or the optimization feature are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T06:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113500","severity":null,"published_at":"2026-10-23T06:17:06+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113500","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113500","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}