CVE-2026-113499— LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting
Quick assessment
Affected
Unknown LiteSpeed Cache
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 7.9.2 版本之前，LiteSpeed Cache WordPress 插件未将其其中一个 HTML 重写流程限制为仅处理样式表内容，导致该流程会移除渲染页面中用于结束属性的引号。结合未转义的评论作者输出，这使得未经认证的用户（只要其评论已被发布）能够注入属性，从而在任意访问者（包括已登录的管理员）浏览前端页面时（在受影响选项启用的情况下）于其浏览器中执行 JavaScript 代码。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | LiteSpeed Cache | < 7.9.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-113499
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting
Source: CVE Program / CVE List V5
Vulnerability Description
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | LiteSpeed Cache | 0 ~ 7.9.2 | - |
|
II. Public POCs for CVE-2026-113499
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-113499
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-23 · 22 CVEs total
| CVE-2026-94263 | 4.8 MEDIUM | Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode E |
| CVE-2026-111965 | 4.3 MEDIUM | Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass |
| CVE-2026-110537 | Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via | |
| CVE-2026-110510 | Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and P | |
| CVE-2026-109935 | Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API | |
| CVE-2026-109933 | Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes | |
| CVE-2026-109934 | Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API | |
| CVE-2026-109936 | Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter | |
| CVE-2026-111737 | Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists | |
| CVE-2026-111738 | Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option | |
| CVE-2026-111966 | Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute | |
| CVE-2026-111982 | Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover vi | |
| CVE-2026-113472 | Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload | |
| CVE-2026-113501 | LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal | |
| CVE-2026-113500 | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization | |
| CVE-2026-112230 | Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter | |
| CVE-2026-112219 | Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved D | |
| CVE-2026-94267 | Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update | |
| CVE-2026-94264 | Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode A | |
| CVE-2026-94262 | Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeo |
Showing top 20 of 22 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: LiteSpeed Cache
-
CVE-2026-113500
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Fon -
CVE-2026-113501
LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative -
CVE-2026-76579
LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via -
CVE-2026-84761
WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Reques -
CVE-2026-3129
LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cros
Same vendor: Unknown
-
CVE-2026-94263
Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthe -
CVE-2026-111965
Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCH -
CVE-2026-94268
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated A -
CVE-2026-94262
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated N -
CVE-2026-94264
Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contrib
V. Comments for CVE-2026-113499
No comments yet