CVE-2026-113499highCWE-79

CVE-2026-113499: high-severity vulnerability in LiteSpeed Cache

LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting

Published

Follow this CVE+ Monitor LiteSpeed Cache

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7.5epss 0.3%
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · LiteSpeed Cache
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — LiteSpeed Cache

In the same product, most dangerous first.

CVE-2021-24964MEDIUMLiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSSEPSS 1.2%CVE-2021-24963—LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site ScriptingEPSS 0.7%CVE-2026-113500HIGHLiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display OptimizationEPSS 0.3%CVE-2026-113501LOWLiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice DismissalEPSS 0.2%