Three Vulnerabilities Disclosed in LiteSpeed Cache WordPress Plugin

What Happened

Three separate vulnerabilities were disclosed for the LiteSpeed Cache WordPress plugin, all affecting versions before 7.9.2. CVE-2026-113499 and CVE-2026-113500 are both stored cross-site scripting (XSS) issues: in each case, an HTML rewriting or optimization routine in the plugin fails to restrict itself to stylesheet content, inadvertently stripping quote or closing-attribute markup from the rendered page. Combined with unescaped comment author output, this allows an unauthenticated user whose blog comment is published to inject attributes that execute JavaScript in a visitor's browser, including a logged-in administrator, when the affected optimization option is enabled. CVE-2026-113501 is a separate issue: the plugin's admin-notice dismissal handler lacks a capability check, and its nonce is not bound to the specific notice being dismissed. This allows a low-privileged authenticated user (Subscriber role) on certain site configurations to dismiss admin notices marked as non-dismissible, including a warning about publicly accessible sensitive files.

Technical Cause

The two XSS issues (CVE-2026-113499, CVE-2026-113500) stem from HTML rewriting/optimization routines that are not properly scoped to stylesheet content, causing them to remove characters that terminate HTML attributes (such as a closing quote or the markup that closes an attribute) in the rendered page. When this markup is stripped and combined with unescaped output of the comment author field, an attacker can craft a comment that, once published, injects new HTML attributes — including event-handler attributes — that execute arbitrary JavaScript for any visitor viewing the page while the optimization feature is active. This is classified as CWE-79 (Cross-Site Scripting). The third issue (CVE-2026-113501) is a broken access control flaw (CWE-862): the handler that processes dismissal of administrative notices does not verify the user's capability level, and the nonce used to authorize the dismissal request is not scoped to a specific notice, allowing it to be reused across notices that should not be dismissible.

Why It Matters

The two XSS vulnerabilities do not require authentication — an attacker only needs the ability to submit a comment that gets published, which is a low barrier on many sites that allow public commenting. Once triggered, the injected JavaScript can run in the browser of any site visitor, including administrators, potentially enabling session hijacking, administrative account compromise, or further site takeover, depending on what actions are possible within an authenticated administrator's session. The admin-notice dismissal issue is lower severity: it does not directly expose confidentiality or availability, but it can allow a low-privileged user to suppress a security warning (such as one indicating sensitive files are publicly accessible), potentially leaving administrators unaware of an existing exposure.

Who Is Affected

Any WordPress site running the LiteSpeed Cache plugin in a version before 7.9.2 is potentially affected. For the two XSS issues, sites are exposed if the relevant HTML optimization option is enabled and the site accepts public comments. For the admin-notice dismissal issue, exposure depends on the site configuration and requires an authenticated low-privileged account (Subscriber role) to exist or be creatable on the site.

Affected Versions

All three vulnerabilities affect LiteSpeed Cache versions before 7.9.2, according to the affected-range data in the advisories.

Fixes and Mitigation

The available advisory data for all three vulnerabilities marks fix availability as unconfirmed, and no fixed version number was supplied in the fact package. The affected-range information references version 7.9.2 as the boundary below which versions are affected, but this briefing cannot confirm whether a patched release has been made available, since fix_available is explicitly recorded as false across all three advisories. Site administrators should treat this as unresolved pending vendor confirmation.

Recommended Action

Check your currently installed LiteSpeed Cache version against the plugin's official changelog and update to the latest available release as a precaution. If the HTML optimization features described in the advisories are not required, consider disabling them until a confirmed fix is verified. Review comment moderation settings to limit unauthenticated comment publication where practical. For the admin-notice issue, review which user roles exist on the site and restrict Subscriber-level account creation or access where not needed. Monitor official plugin update channels for a confirmed security release.