CVE-2026-113499 LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment ...

CVE-2026-113499

The LiteSpeed Cache WordPress plugin (versions before 7.9.2 ) is vulnerable to an unauthenticated stored XSS via CDN inline CSS rewriting. The root cause is that the plugin fails to restrict an HTML rewriting routine to stylesheet content, causing it to remove a quote that terminates an attribute...