CVE-2026-113500: CWE-79 Cross-Site Scripting (XSS) in LiteSpeed Cache

The LiteSpeed Cache WordPress plugin prior to version 7.9.2 contains a CWE-79 cross-site scripting vulnerability. The issue is due to an HTML optimization routine that is not limited to stylesheet content and can remove the markup closing an attribute in the rendered page. This flaw, combined with unescaped comment author output, allows unauthenticated users whose comments are published to inject event-handler attributes that execute JavaScript in the browsers of visitors, including administrators. This vulnerability requires the optimization feature to be enabled and published comments by unauthenticated users.

Successful exploitation allows unauthenticated users with published comments to execute arbitrary JavaScript in the browsers of any visitor to the affected site, including logged-in administrators. This can lead to session hijacking, privilege escalation, or other malicious actions executed in the context of the affected website's users.

A fix is available in LiteSpeed Cache version 7.9.2. Users should upgrade to version 7.9.2 or later to remediate this vulnerability. Until then, disabling the HTML optimization feature that triggers this issue may reduce risk. Patch status is confirmed by the versioning information indicating the vulnerability affects versions before 7.9.2.