HTML Injection in LiteSpeed Cache WordPress Plugin Affects Unauthenticated Users
CVE-2026-113499
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 October 2026
Badges
What is CVE-2026-113499?
The LiteSpeed Cache plugin for WordPress prior to version 7.9.2 contains a flaw that allows unauthenticated users to exploit an HTML rewriting routine. This vulnerability does not properly restrict its actions, enabling malicious users to inject arbitrary attributes that execute JavaScript within the browsers of visitors, including admins, who access the affected site. This issue poses a risk when comment authors are not properly sanitized, potentially leading to severe security implications for users and website administrators.
Affected Version(s)
LiteSpeed Cache 0 < 7.9.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.