CVE-2026-113499: CWE-79 Cross-Site Scripting (XSS) in LiteSpeed Cache

CVE-2026-113499 is a Cross-Site Scripting (CWE-79) vulnerability in the LiteSpeed Cache WordPress plugin prior to version 7.9.2. The vulnerability occurs because one of the plugin's HTML rewriting routines is not restricted to stylesheet content and removes a quote terminating an attribute in the rendered page. When combined with unescaped comment author output, this flaw enables unauthenticated users whose comments are published to inject malicious attributes that execute JavaScript in the browsers of any visitor viewing front-end pages with the vulnerable option enabled.

An attacker can inject JavaScript code via a published comment that executes in the context of any visitor's browser, including logged-in administrators. This can lead to session hijacking, privilege escalation, or other malicious actions executed in the victim's browser. The vulnerability requires that the attacker's comment be published and the affected option enabled, but no authentication is required to submit the comment.

A fixed version 7.9.2 of LiteSpeed Cache addresses this vulnerability. Users should upgrade to version 7.9.2 or later to remediate this issue. Since no vendor advisory or patch link is provided, confirm patch availability from the official LiteSpeed Cache plugin sources before applying. Until patched, consider disabling the affected HTML rewriting option if possible to mitigate risk.