PT-2026-121772

CVE-2026-113499

Published

2026-10-23

Updated

2026-11-13

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LiteSpeed Cache WordPress plugin versions prior to 7.9.2

Description An issue exists where an HTML rewriting routine is not restricted to stylesheet content, causing the removal of a quote that terminates an attribute in the rendered page. When combined with unescaped comment author output, this allows unauthenticated users with published comments to inject attributes that execute JavaScript in the browser of any visitor, including logged-in administrators, provided the affected option is enabled.

Recommendations Update LiteSpeed Cache WordPress plugin to version 7.9.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jakub Herman

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers