Reflected Cross-Site Scripting Vulnerability in LiteSpeed Cache Plugin for WordPress

CVE-2026-76579

What is CVE-2026-76579?

The LiteSpeed Cache plugin for WordPress has a security vulnerability that allows unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS). This occurs through the manipulation of the 'esi' parameter due to inadequate input sanitization and output escaping. An attacker can exploit this issue by convincing a user to click on a specially crafted link, which injects malicious scripts into web pages. Successful exploitation requires the attacker to provide a valid 'esi' value in the GET request while including a harmful payload as a POST body. This design flaw hinges on PHP's default behavior of merging $_REQUEST parameters, allowing the attacker-controlled POST value to be executed preferentially.

References