Published October 23, 2026. Based on public CVE records available on that date; details may change.

Three CVEs published on October 23, 2026 affect the LiteSpeed Cache WordPress plugin before version 7.9.2: two stored cross-site scripting (XSS) issues that an unauthenticated commenter can trigger, and one missing authorization check. Update LiteSpeed Cache to 7.9.2, which is the current version on WordPress.org, then review recently published comments and the plugin's admin notices.

What happened

All three issues were reported through WPScan, which assigned the CVEs, and all three records list LiteSpeed Cache before 7.9.2 as affected. LiteSpeed Cache has 7,000,000+ active installations on WordPress.org as of October 23, 2026, so many sites are in scope even though each issue has conditions.

CVE-2026-113499 (titled "Unauthenticated Stored XSS via CDN Inline CSS Rewriting"): one of the plugin's HTML rewriting routines is not limited to stylesheet content. According to the record, it removes a quote that ends an HTML attribute in the rendered page. Combined with comment author output that is not escaped, a visitor whose comment gets published can inject attributes that run JavaScript in the browser of anyone viewing front-end pages, including a logged-in administrator, while the affected option is enabled.

CVE-2026-113500 (titled "Unauthenticated Stored XSS via Font Display Optimization"): a similar problem in a different optimization routine. The record says it can delete the markup that closes an attribute, which again lets a published commenter inject event-handler attributes that run JavaScript for visitors and logged-in administrators while the optimization is enabled.

CVE-2026-113501 (titled "Subscriber+ Pinned Administrative Notice Dismissal"): the plugin's admin-notice dismissal handler has no capability check, and the nonce it relies on is not tied to the specific notice. On sites in certain configurations, a Subscriber can dismiss notices the plugin marks as non-dismissible, including a warning that sensitive files may be publicly accessible.

In plain terms, the two XSS issues are a chain. The commenter supplies the payload, a theme or template prints the comment author without escaping, and the LiteSpeed optimization step breaks the HTML structure that would otherwise keep the payload harmless. If any one of those pieces is missing, the records do not describe a working attack.

Severity and exploitation status

The CVE records themselves do not include a CVSS score. WPScan's own database entries rate CVE-2026-113499 and CVE-2026-113500 at 7.5 (high) and CVE-2026-113501 at 3.1 (low). Treat those as WPScan's assessment rather than an official score in the CVE record.

The records reviewed for this article do not mention exploitation in the wild. WPScan's entries say proof-of-concept details will be displayed on November 5, 2026 for CVE-2026-113501 and on November 22, 2026 for the two XSS issues. Public proof-of-concept code usually makes attacks easier to copy, so update before those dates.

Who is affected

Any site running LiteSpeed Cache older than 7.9.2 has the vulnerable code. Exposure to the XSS issues is higher when:

  • Comments are open and can be published without manual approval, or a previously approved commenter's later comments are published automatically.
  • The theme or another template prints comment author names without escaping.
  • The affected optimization options are enabled. The record titles point to CDN inline CSS rewriting and to Font Display Optimization.

For CVE-2026-113501, the condition is that a low-privilege account exists. Sites that let visitors register as Subscribers, such as membership sites and stores with customer accounts, have that condition by default.

How to check your site

Start by confirming the installed version.

  1. In the WordPress admin, open Plugins and find LiteSpeed Cache. Note the version number.
  2. With WP-CLI, run wp plugin list --name=litespeed-cache from the WordPress directory to see the status and version.
  3. Run wp plugin get litespeed-cache --field=version if you only want the version number.
  4. Repeat for staging and development copies, which often lag behind production.

If the version is lower than 7.9.2, the site is affected. Also check whether automatic updates are enabled for the plugin on the Plugins screen, so the next release does not wait for someone to notice.

Then look at comments. Open Comments and review recently approved comments, paying attention to the author name field. A name that contains HTML-like characters, quotes, or words such as onmouseover or onerror is a red flag. With WP-CLI, wp comment list --status=approve --fields=comment_ID,comment_author,comment_date gives a quick list you can scan.

What to do now

The fix is to update LiteSpeed Cache to 7.9.2. Use Dashboard > Updates, the Plugins screen, or wp plugin update litespeed-cache. The 7.9.2 changelog lists hardening work across page optimization, cache, configuration, and other areas, so check the site's front end and admin after updating.

If you cannot update right away, reduce exposure until you can:

  • Set comments to require manual approval under Settings > Discussion, or close comments temporarily.
  • Review the plugin's CDN and Page Optimization settings and turn off the affected options if you do not need them.
  • Purge the LiteSpeed cache after any change, so cached pages with the old output are not served.

After the update, purge the cache and remove any suspicious comments. Then revisit the plugin's admin notices: if a warning about sensitive files being publicly accessible appears, act on it rather than dismissing it. A notice that disappeared without anyone on your team dismissing it is worth a closer look.

If an administrator viewed pages carrying a malicious comment, treat the account as possibly exposed. Check for new administrator accounts with our guide to finding hidden WordPress admin users, and if anything looks wrong, follow how to fix a hacked WordPress site. Tightening comment moderation and user registration is also part of the WordPress hardening checklist.

When to get help

Get help if you find comments with script-like author names, admin accounts nobody recognizes, or plugin and theme changes your team did not make. WordPress malware removal is the right starting point for a suspected compromise, and a security audit can review your caching, comment, and registration settings together.

Sources