HTML Optimization Vulnerability in LiteSpeed Cache for WordPress
CVE-2026-113500
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 October 2026
Badges
What is CVE-2026-113500?
A vulnerability exists in the LiteSpeed Cache plugin for WordPress prior to version 7.9.2, which fails to restrict an HTML optimization routine to stylesheet content. This oversight allows for the deletion of closing markup attributes in the rendered output. When paired with unescaped output from comment authors, this enables unauthenticated users with published comments to insert event-handler attributes into the HTML. Consequently, this could execute JavaScript in the browsers of any visitors, including logged-in administrators, who access the affected front-end pages while the optimization feature is enabled.
Affected Version(s)
LiteSpeed Cache 0 < 7.9.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.