CVE-2026-116763— LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)
Quick assessment
Affected
litespeedtech LiteSpeed Cache
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 LiteSpeed Cache 插件在所有 7.9.1 及更早版本中，因输入清理和输出转义不足，存在通过"comment"参数触发的存储型跨站脚本（Stored XSS）漏洞。该漏洞允许未认证的攻击者在页面上注入任意 Web 脚本，这些脚本会在用户访问被注入的页面时执行。此漏洞仅在同时满足以下两个条件时才可被利用：1）启用了 HTML 压缩选项（O_OPTM_HTML_MIN）；2）同一页面上存在某个配套插件，将存储的评论内容以原始文本上下文（例如 JSON-LD 脚本块）进行渲染。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1071 · Application Layer Protocol T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-116763
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)
Source: CVE Program / CVE List V5
Vulnerability Description
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the HTML Minify option (O_OPTM_HTML_MIN) is enabled and a companion plugin renders stored comment content into a raw-text context such as a JSON-LD script block on the same page.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| litespeedtech | LiteSpeed Cache | 0 ~ 7.9.1 | - |
|
II. Public POCs for CVE-2026-116763
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-116763
请登录查看更多情报信息。
Other References for CVE-2026-116763 (7)
IV. Related Vulnerabilities
Same product: LiteSpeed Cache
-
CVE-2026-109215
LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Store -
CVE-2026-114190
WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exp -
CVE-2026-113501
LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative -
CVE-2026-113499
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN -
CVE-2026-113500
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Fon
Same vendor: litespeedtech
-
CVE-2026-109215
LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Store -
CVE-2026-115482
lsquic 4.9.0 前 HTTP/3 QPACK 内存放大漏洞 -
CVE-2026-104474
OpenLiteSpeed before 1.9.3 Local Privilege Escalation via ls -
CVE-2026-93903
LiteSpeed Web Server 6.3.7前内部重定向验证漏洞 -
CVE-2026-76579
LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via
Same weakness: CWE-79
-
CVE-2026-115821
NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scr -
CVE-2026-109216
Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cros -
CVE-2026-96767
NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scrip -
CVE-2026-5700
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC -
CVE-2026-5699
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC