---
id: "CVE-2026-113500"
kind: "vulnerability"
aliases: ["CVE-2026-113500"]
title: "LiteSpeed Cache WordPress plugin: comment injection runs JavaScript in visitor browsers"
severity: "high"
cvss: 7.5
epss: 0.00187
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["litespeed-cache", "package", "self-hosted", "wordpress"]
not_affected_if: ["html-optimization-disabled", "plugin-at-7.9.2-or-later"]
published_at: "2026-10-23T06:17:06+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:14:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113500", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-113500", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# LiteSpeed Cache WordPress plugin: comment injection runs JavaScript in visitor browsers

The LiteSpeed Cache plugin before 7.9.2 has an HTML optimization routine that is not limited to stylesheet content, and it can remove the closing quote of an attribute in rendered pages. Combined with unescaped comment author output, an unauthenticated commenter can inject event-handler attributes that run JavaScript in any visitor's browser, including a logged-in administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed LiteSpeed Cache plugin version in the WordPress admin under Plugins, or with `wp plugin get litespeed-cache --field=version`
- Check whether HTML optimization is enabled in the LiteSpeed Cache settings (unknown if the sources give the exact option name)

## Fix

- Update the LiteSpeed Cache plugin to `7.9.2` or later
- Until updated, disable the HTML optimization feature in LiteSpeed Cache settings (unknown exact menu path from sources)

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113500
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-113500

## From the sources

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_