Multiple XSS vulnerabilities patched in WordPress plugins October 2026
Sucuri publishes October 2026 roundup of medium and high-risk flaws in Elementor, LiteSpeed Cache, and WooCommerce.
70
Vulnerability1 · 1 read
CVE-2026-113500
Stored XSS in LiteSpeed Cache before 7.9.2
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
LiteSpeed Cache for WordPress before 7.9.2 lets an HTML optimization routine alter more than stylesheet content, so it can remove markup that closes an attribute. Combined with unescaped comment-author output, an unauthenticated user whose comment is published can inject event-handler attributes. Those attributes run JavaScript in any visitor's browser, including a logged-in administrator, on front-end pages while optimization is enabled.
What to do: Upgrade the LiteSpeed Cache WordPress plugin to 7.9.2.
| Product | Affected | Fixed in |
|---|---|---|
| LiteSpeed Cache | before 7.9.2 | 7.9.2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.
- Ecosystems
- WordPress
- Weakness
- CWE-79
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H