CVE-2026-76579

Name of the Vulnerable Software and Affected Versions LiteSpeed Cache versions prior to 8.0

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link containing a validly signed esi value in the GET query string, while simultaneously submitting an attacker-controlled esi payload via a POST body field. The attack leverages PHP's default $ REQUEST merge order to ensure the POST value takes precedence during execution, enabling the injection of arbitrary web scripts into pages.

Recommendations Update the plugin to a version newer than 7.9. Avoid using the esi parameter in requests until the update is applied.