CVE-2026-18978

Name of the Vulnerable Software and Affected Versions LiteSpeed Cache versions prior to 7.8.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This is achieved by using a comment payload composed of decimal numeric character references within an allowed element like <code>, which bypasses the wp kses() sanitization function because it does not recognize a data-settings substring within text content as an HTML attribute. Exploitation requires the site to allow users with previously approved comments to post new ones and for the require name email setting to be disabled.

Recommendations Update to version 7.8.2 or later. Enable the require name email setting to restrict comment submissions.