CVE-2026-18978: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in litespeedtech LiteSpeed Cache

CVE-2026-18978 is a stored cross-site scripting vulnerability in the LiteSpeed Cache WordPress plugin affecting all versions up to 7.8.1. The flaw is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of comment content. Attackers can craft a payload using decimal numeric character references within allowed HTML elements (e.g., <code>) to bypass WordPress's wp_kses sanitization. This bypass occurs because wp_kses does not recognize certain substrings (like data-settings="...") within text content as HTML attributes, allowing malicious scripts to reach vulnerable functions and execute in users' browsers. Exploitation conditions include the ability for users with approved comments to post new comments and the disabling of the require_name_email setting.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary JavaScript in the context of the affected site, potentially leading to information disclosure and limited integrity impacts. The vulnerability does not affect availability. The CVSS v3.1 score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider enabling the require_name_email setting and restricting comment posting permissions to trusted users only to reduce exploitation risk. Monitor vendor channels for updates and apply official patches once released.