Security Updates for LSCWP

We have a security update for LiteSpeed Cache for WordPress. Recently, we were made aware of three vulnerabilities in the LiteSpeed Cache for WordPress plugin. We patched them in v7.9.2.

To protect your WordPress sites, please update to the latest version of the LSCache plugin immediately.

These vulnerabilities are covered by the following three CVEs:

• CVE-2026-113499: Cross-site scripting
• CVE-2026-113500: Cross-site scripting
• CVE-2026-113501: Missing authorization

Impact #1

The cross-site scripting vulnerabilities may be exploited in LiteSpeed Cache versions before 7.9.2. A site is affected only when all of the following are true:

• The site accepts comments, and a comment from an unauthenticated visitor gets published.
• The site’s theme or other code outputs the comment author’s name without escaping it.

• For CVE-2026-113499, the site has the following settings:
  • CDN > Other Static CDN > Use CDN Mapping is ON
  • CDN > Other Static CDN > CDN URL is defined
  • CDN > Other Static CDN > Include Images is ON

• For CVE-2026-113500, the site has the following setting:
  • Page Optimization > CSS Settings > Font Display Optimization is set to Swap.

If those conditions are met, an unauthenticated attacker could get a script to run in the browser of anyone who visits an affected page. The attacker doesn’t need an account. If the visitor is logged in as an administrator, the script would run with their permissions.

Sites that have neither option enabled aren’t affected.

Impact #2

CVE-2026-113501 is a missing authorization check in LiteSpeed Cache versions before 7.9.2. It’s a separate issue from the two XSS vulnerabilities above. A site is affected only when the following is true:

• An attacker can log in with an account that has at least the Subscriber role. On sites that allow open user registration, anyone can get such an account.

If that condition is met, the attacker could dismiss administrative notices pinned by the plugin. Dismissing them could keep the site owner from seeing a warning they would otherwise act on.

The issue doesn’t give the attacker access to site data, and it doesn’t let them run code or take over accounts.

Actions

We recommend that every site upgrade to the plugin version 7.9.2 or higher to patch these vulnerabilities. If you are unable to update right away, you can mitigate the XSS vulnerabilities by turning on comment moderation.

Timeline

• October 19, 2026: We patched the issue with a week of notification and released v7.9.2 to the WordPress repository
• October 23, 2026: We added v7.9.2 to the list of stable releases in our control panel plugins

Conclusion

These vulnerabilities have been patched, so if you are keeping your LiteSpeed Cache plugin up-to-date, there is nothing you need to do. If you have not updated in a while, please do so today.