CVE-2026-76579 is a reflected Cross-Site Scripting vulnerability in the LiteSpeed Cache WordPress plugin affecting all versions up to 7.9. The flaw is due to improper neutralization of input during web page generation, specifically via the 'esi' parameter. Attackers can inject arbitrary web scripts by supplying a valid signed 'esi' value in the GET query string and a malicious 'esi' payload in the POST body, exploiting PHP's default $_REQUEST variable precedence. This vulnerability allows execution of attacker-controlled scripts in the context of the victim's browser if the victim is tricked into interacting with a crafted link.

An unauthenticated attacker can execute arbitrary scripts in the context of a victim's browser by exploiting the reflected XSS vulnerability. This can lead to limited confidentiality and integrity impacts such as theft of session tokens or manipulation of displayed content. The vulnerability does not affect availability. The CVSS score of 4.7 reflects a medium severity with network attack vector, high attack complexity, no privileges required, and requiring user interaction.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, avoid using untrusted input in the 'esi' parameter and consider disabling features that process this parameter if feasible. Implementing web application firewall (WAF) rules to detect and block suspicious 'esi' parameter usage may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.