CVE-2026-113500 in LiteSpeed Cache Plugin
Summary
by MITRE • 10/23/2026
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in LiteSpeed Cache versions prior to 7.9.2 represents a critical intersection of improper input validation and insecure output encoding within a widely deployed WordPress plugin. The core technical flaw resides in an HTML optimization routine designed to minify or optimize stylesheet content for performance enhancement. This specific routine fails to strictly confine its processing logic to valid CSS syntax, thereby inadvertently applying destructive parsing operations to the broader HTML document structure. Specifically, the algorithm incorrectly strips closing tags associated with HTML attributes when it encounters certain patterns that resemble malformed style definitions. This behavior results in the corruption of the Document Object Model by removing essential syntactic elements required for proper browser rendering and security boundaries.
This structural manipulation creates a severe cross-site scripting vector when combined with another vulnerability involving unescaped comment author output. In standard WordPress configurations, user-generated content such as comments is often displayed on public-facing pages without sufficient sanitization of specific special characters in the display context. When an attacker publishes a comment containing malicious JavaScript payloads embedded within event-handler attributes, the system normally would escape or neutralize these inputs to prevent execution. However, due to the aforementioned HTML optimization bug, the closing quote and tag required to properly terminate the attribute are stripped from the rendered page source. This removal effectively leaves the injected payload open-ended, allowing the browser's parser to interpret subsequent content as part of the malicious attribute value rather than distinct DOM nodes.
The operational impact of this vulnerability is significant because it allows unauthenticated attackers to execute arbitrary JavaScript in the context of any visitor viewing a vulnerable front-end page where HTML optimization is enabled. This includes high-privilege users such as logged-in administrators, thereby facilitating account takeover scenarios. The attack does not require authentication for initiation, making it particularly dangerous against sites with public comment sections or guest access features. Once executed, the injected script can perform actions on behalf of the victim user, including stealing session cookies, performing authenticated requests to change site settings, defacing the website content, or redirecting users to phishing pages. The persistence of this risk depends entirely on whether the administrator has enabled HTML optimization within the LiteSpeed Cache plugin configuration.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically relates to CWE-830 Inclusion of Functionality from Untrusted Control Sources due to the improper handling of user input in optimization routines. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, where JavaScript is used for execution, and potentially T1078 Valid Accounts if the payload targets administrative functions after stealing credentials via cookie theft. The root cause can be further categorized under CWE-20 Improper Input Validation as the plugin fails to validate that optimization routines are applied only to their intended data types.
Mitigation strategies must focus on immediate remediation and defensive configuration changes. The primary and most effective solution is to upgrade the LiteSpeed Cache WordPress plugin to version 7.9.2 or later, where this parsing logic has been corrected to strictly limit HTML attribute manipulation to valid stylesheet contexts only. Until an update can be applied, administrators should consider disabling the specific HTML optimization feature that triggers the bug if it is currently enabled in the plugin settings. Additionally, implementing a Web Application Firewall with rulesets tuned for WordPress environments can help block common cross-site scripting payloads before they reach the application layer. Regular security audits and penetration testing of comment sections are recommended to ensure no other input validation gaps exist that could be exploited similarly.