LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS (CVE-2026-113499, CVE-2026-113500)

LiteSpeed Cache versions before 7.9.2 contain two unauthenticated stored XSS vulnerabilities affecting specific CDN and font optimization configurations. Update immediately and purge cached pages.

LiteSpeed Cache for WordPress versions before 7.9.2 contain two high-severity stored cross-site scripting vulnerabilities. Both flaws can let an unauthenticated commenter inject JavaScript when a vulnerable optimization path processes a page and the site’s theme or custom code prints the comment author’s name without proper escaping. LiteSpeed Cache has more than seven million active installations.

Table of Contents

Vulnerability summary

Affected plugin: LiteSpeed Cache for WordPress
Affected versions: all versions before 7.9.2
Fixed version: 7.9.2
CVE-2026-113499: unauthenticated stored XSS through CDN inline CSS URL rewriting
CVE-2026-113500: unauthenticated stored XSS through Font Display Optimization
Severity: High, CVSS 7.5 according to WPScan/Patchstack
Privileges required: none, but an attacker-controlled comment must be published
Related issue: CVE-2026-113501 allows a Subscriber-level user to dismiss pinned LiteSpeed Cache administrative notices; it is low severity and also fixed in 7.9.2

When a site is exploitable

The XSS flaws are configuration-dependent. The site must accept comments, an attacker’s comment must become public, and the active theme or another component must output the comment author’s name without escaping it.

For CVE-2026-113499, LiteSpeed says CDN Mapping must be enabled, a CDN URL must be configured, and the Include Images option must be enabled. For CVE-2026-113500, Font Display Optimization must be set to Swap. The vulnerable optimization routines can alter HTML boundaries around attacker-controlled output and create an executable event-handler attribute in the rendered page.

Successful exploitation runs JavaScript in the browser of visitors who open the affected page. If a logged-in administrator views it, the script executes in that administrator’s WordPress session, which can expose administrative actions to abuse.

Immediate remediation

Update LiteSpeed Cache to version 7.9.2 or later.
Purge the LiteSpeed page cache after updating so previously generated vulnerable HTML is not served.
Review recently approved comments and remove suspicious author names, URLs, or unexpected markup.
Until the update is complete, require manual comment approval. If that is not possible, temporarily disable CDN Mapping and set Font Display Optimization to a value other than Swap.
Verify that themes and custom templates escape comment-author output with the appropriate WordPress escaping functions.

Verify the installed version

wp plugin get litespeed-cache --field=version
wp plugin update litespeed-cache
wp cache flush

The first command should return 7.9.2 or a later version after remediation. On LiteSpeed servers, also purge through the LiteSpeed Cache dashboard or hosting control panel if the generic cache flush does not clear all page-cache layers.

Review potentially exposed comments

Administrators can list recently approved comments without exposing comment content:

wp comment list --status=approve --fields=comment_ID,comment_date,comment_author,comment_author_url --format=table

Investigate unexpected author names or URLs and compare web access logs around the publication and viewing times of suspicious comments. Also review administrator activity, newly created users, plugin changes, and modified theme files if a suspicious comment was viewed by a logged-in administrator.