Review
LiteSpeed
CVE published 2026-10-23
CVE-2026-113499
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, allowing unauthenticated users to inject attributes that execute JavaScript in the browser of any visitor. This vulnerability can lead to stored XSS attacks on affected sites, emphasizing the need for prompt updates and monitoring. Defenders should assess exposure and prioritize up [truncated]