CVE-2026-116763 in LiteSpeed Cache Plugin
Summary
by MITRE • 10/29/2026
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the HTML Minify option (O_OPTM_HTML_MIN) is enabled and a companion plugin renders stored comment content into a raw-text context such as a JSON-LD script block on the same page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The LiteSpeed Cache plugin for WordPress, specifically in versions up to 7.9.1, contains a critical security flaw classified as Stored Cross-Site Scripting (XSS). This vulnerability stems from insufficient input sanitization and output escaping mechanisms within the application logic that handles user-generated content. The primary vector of exploitation is the comment parameter, which allows unauthenticated attackers to inject arbitrary web scripts into the database. Unlike reflected XSS attacks where malicious code is executed immediately upon request, stored XSS persists on the server side, meaning the injected payload remains active until it is manually removed from the database or the affected page content is updated. This persistence significantly increases the risk profile, as every user who views a page containing the compromised comment will trigger the execution of the attacker's script in their browser context.
The technical mechanics of this vulnerability rely on a specific configuration state and interaction with other plugins within the WordPress ecosystem. The exploitability condition requires that the HTML Minify option, identified internally as O_OPTM_HTML_MIN, be enabled. When this optimization feature is active, it processes page content to reduce file size by removing whitespace and comments. However, in conjunction with certain companion plugins that render stored comment data into raw-text contexts such as JSON-LD script blocks, the sanitization logic fails to properly escape special characters. This failure allows malicious JavaScript code embedded within a comment to bypass standard filtering rules and be interpreted directly by the browser's JavaScript engine when the page is rendered. The combination of minification processes and improper escaping in structured data formats creates an environment where injected scripts are not neutralized but rather preserved and executed as part of the page load sequence.
From an operational impact perspective, this vulnerability poses severe risks to both website administrators and end-users. Successful exploitation allows attackers to perform session hijacking by stealing authentication cookies or tokens stored in local storage, potentially leading to unauthorized administrative access. It also enables credential harvesting through fake login forms injected into legitimate pages, phishing attacks that deceive users into revealing sensitive information, and defacement of the website content. Furthermore, because the attack is triggered automatically upon page view without requiring user interaction beyond visiting a specific URL, it facilitates widespread compromise if high-traffic pages are targeted. The ability to execute arbitrary code in the context of the victim’s browser means attackers can manipulate DOM elements, redirect users to malicious sites, or install malware on client systems depending on browser vulnerabilities and security settings.
To mitigate this vulnerability, immediate action is required for all WordPress installations running LiteSpeed Cache versions 7.9.1 or earlier. The primary remediation step is to upgrade the plugin to a patched version where input sanitization and output escaping have been rigorously strengthened. Administrators should verify that updates are applied promptly through the official WordPress repository or vendor channels. In addition to patching, security hardening measures include disabling the HTML Minify feature if it is not strictly necessary for performance optimization, thereby removing one of the conditions required for exploitation. Implementing a Web Application Firewall (WAF) can also provide an additional layer of defense by detecting and blocking common XSS payloads before they reach the application logic. Regular audits of installed plugins are recommended to ensure compatibility with security patches and to identify any companion plugins that might interact dangerously with comment rendering processes.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack pattern corresponds to ATT&CK technique T1059, specifically the execution of JavaScript within a browser environment via web application vulnerabilities. Understanding these classifications helps in mapping the threat landscape and prioritizing remediation efforts based on industry-standard frameworks for vulnerability management. By addressing both the immediate code flaw and the broader configuration dependencies, organizations can effectively neutralize this risk vector and maintain the integrity of their WordPress-based infrastructure against persistent cross-site scripting threats.