CVE-2026-113499 LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-113499?
CVE-2026-113499 is a high-severity vulnerability in Unknown LiteSpeed Cache, published on 23 Oct 2026.
Official description
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.
Weakness: CWE-79
Which versions are affected by CVE-2026-113499?
How do I fix CVE-2026-113499?
No fix has been published for CVE-2026-113499 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-113499 being exploited?
There is no known exploitation of CVE-2026-113499 in the wild and no public exploit code.
Sources
Also known as GHSA-vm5g-h8fh-8cpp.