---
id: CVE-2026-113500
title: >-
  LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display
  Optimization
summary: >-
  The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its
  HTML optimization routines to stylesheet content, so it can delete the markup
  that closes an attribute in the rendered page, and combined with unescaped
  comment …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-79
product: LiteSpeed Cache
affected:
  - litespeed_cache < 7.9.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-23T10:37:02.256073Z'
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T10:46:03.416Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113500'
references:
  - url: 'https://wpscan.com/vulnerability/f841e09f-275c-4c10-a5b7-af294f92db29/'
tags:
  - cve.org
ingestedAt: '2026-10-23T06:17:25.171Z'
---

## Overview

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.

## Affected

- `litespeed_cache < 7.9.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.