CVE-2026-113500

Name of the Vulnerable Software and Affected Versions LiteSpeed Cache WordPress plugin versions prior to 7.9.2

Description An HTML optimization routine fails to limit its operations to stylesheet content, which can lead to the deletion of markup that closes an attribute in the rendered page. When combined with unescaped comment author output, this allows unauthenticated users with published comments to inject event-handler attributes. This results in the execution of arbitrary JavaScript in the browser of any visitor, including logged-in administrators, when viewing front-end pages with the optimization enabled.

Recommendations Update LiteSpeed Cache WordPress plugin to version 7.9.2 or later.