CVE-2026-18978

CVE-2026-18978 is a stored cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin for WordPress, affecting all versions up to and including 7.8.1, caused by insufficient input sanitization and output escaping of comment content. An unauthenticated attacker can submit a comment composed entirely of decimal numeric character references (such as &#34;, &#60;, and &#62;) inside an allowed element like <code>; WordPress's wp_kses sanitizer does not treat the resulting data-settings attribute-like substring within text content as an actual HTML attribute, so the payload survives sanitization and executes whenever a user accesses the page containing the injected comment. Exploitation additionally requires the site to allow commenters with a previously approved comment to write new comments without moderation and to have the require_name_email setting disabled. An attacker gains arbitrary web script execution in the browsers of users viewing affected pages, which can enable actions such as cookie theft, unwanted page actions, or redirects (CVSS 3.1 rates this 7.2 High with changed scope and low confidentiality/integrity impact). No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and EPSS estimates only a 0.3% probability of exploitation within the next 30 days.

What to do: Upgrade LiteSpeed Cache to a release newer than 7.8.1 as soon as a patched version is published (no fixed version number is specified in the source data). Until patching, mitigate by enabling the require_name_email comment setting or by requiring moderation of all comments so commenters cannot publish without approval, and audit recently published comments for payloads built from numeric character references inside <code> elements. Site owners should also verify whether their discussion settings allow commenters with a single previously approved comment to post without moderation, since that configuration is a prerequisite for this flaw.