CVE-2026-113500 LiteSpeed Technologies CVE debrief

Who should care

Defenders responsible for WordPress installations with the LiteSpeed Cache plugin should assess exposure and prioritize updating to version 7.9.2 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the vulnerability and take necessary actions to prevent exploitation.

Why it matters

The LiteSpeed Cache WordPress plugin vulnerability allows unauthenticated users to inject malicious JavaScript code, potentially leading to unauthorized actions or data theft.

• Unauthenticated stored XSS vulnerability allows attackers to inject malicious JavaScript code
• Code execution in the browser of any visitor, including logged-in administrators
• Potential for unauthorized actions or data theft

Technical summary

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, allowing unauthenticated users with published comments to inject event-handler attributes that run JavaScript in the browser of any visitor, including logged-in administrators, when the optimization is enabled. The vulnerability can lead to unauthorized actions or data theft. The affected product is LiteSpeed Cache, and defenders should prioritize verifying the version installed on their systems and updating to version 7.9.2 or later if necessary.

Defensive priority

Defenders should prioritize verifying the version of LiteSpeed Cache installed on their systems and updating to version 7.9.2 or later if necessary.

Recommended defensive actions

• Verify the version of LiteSpeed Cache installed on your system
• Update to version 7.9.2 or later if necessary
• Monitor for suspicious activity on your system
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but the impact and remediation require verification from official sources. The vulnerability allows unauthenticated users to inject malicious JavaScript code, potentially leading to unauthorized actions or data theft. Defenders should verify the version of LiteSpeed Cache installed on their systems and update to version 7.9.2 or later if necessary. The source item and CVE record provide evidence of the vulnerability, but additional verification is required to confirm

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.