CVE-2026-116763

Name of the Vulnerable Software and Affected Versions LiteSpeed Cache versions prior to 7.9.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the comment parameter. Exploitation is possible when the HTML Minify option O OPTM HTML MIN is enabled and a companion plugin renders stored comment content into a raw-text context, such as a JSON-LD script block.

Recommendations Update to version 7.9.2 or later. Disable the O OPTM HTML MIN HTML Minify option as a temporary mitigation.