CVE-2026-113500 LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-113500?
CVE-2026-113500 is a high-severity vulnerability in Unknown LiteSpeed Cache, published on 23 Oct 2026.
Official description
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.
Weakness: CWE-79
Which versions are affected by CVE-2026-113500?
How do I fix CVE-2026-113500?
No fix has been published for CVE-2026-113500 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-113500 being exploited?
There is no known exploitation of CVE-2026-113500 in the wild and no public exploit code.
Sources
Also known as GHSA-grhh-22v9-vc32.