Multiple XSS vulnerabilities patched in WordPress plugins October 2026
Sucuri publishes October 2026 roundup of medium and high-risk flaws in Elementor, LiteSpeed Cache, and WooCommerce.
70
Vulnerability1 · 1 read
CVE-2026-114190
Sensitive Data Exposure in LiteSpeed Cache before 7.9
- CVSS 3.1
- 5.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
LiteSpeed Cache allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. This affects WordPress users of the plugin from version n/a through 7.9. An attacker can trigger this flaw over the network with high complexity and no user interaction, potentially gaining access to sensitive information.
What to do: Upgrade to the latest LiteSpeed Cache version for CVE-2026-114190. No workaround provided.
| Product | Affected |
|---|---|
| LiteSpeed Cache litespeed-cache | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9.
- Ecosystems
- WordPress
- Weakness
- CWE-201
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N