LiteSpeed Cache CVE-2026-113499

Exploitation requires the LiteSpeed Cache HTML-rewriting/optimization option that performs the mis-scoped rewrite to be enabled (the description ties the bug to 'while the affected option is enabled', so it is configuration-dependent and not guaranteed on default installs), and it requires that the attacker's comment actually be published - any comment moderation or approval requirement is a gating factor. The payload only fires when a visitor, specifically a logged-in administrator viewing front-end pages, loads the page rendering the comment (CVSS UI:R). The exact option name/setting is not described in the available sources. These factors - non-default rewriting option, comment-publication gate, and required victim page view - materially limit real-world exploitability despite the network, unauthenticated entry point.

This is a stored cross-site scripting flaw (CWE-79) in the LiteSpeed Cache WordPress plugin before 7.9.2. The signals point to a moderate, non-urgent priority rather than an emergency. SSVC reports Exploitation: none and Automatable: no, there is no CISA KEV listing, and no EPSS score was supplied, so there is no evidence of active or at-scale exploitation; the vuln.today decision label is 'this_week', consistent with patch-this-cycle rather than drop-everything urgency. Technical Impact is rated 'total' in SSVC, which reflects worst-case consequence (script execution in a logged-in administrator's browser, enabling account takeover) rather than likelihood. The input CVSS is 7.5 with AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H: network-reachable and unauthenticated (an attacker only needs to post a comment), but gated by AC:H and UI:R, meaning a non-default option must be enabled and a victim must load the affected front-end page. The C:H/I:H/A:H impact rating is generous for a reflected-into-page XSS; the realistic impact is admin session/action compromise, which I weight as limited-to-moderate confidentiality and integrity impact with a scope change into the victim's browser context. No conflicting data on attack vector was found, but note the high impact metrics describe the admin-takeover worst case, not a guaranteed outcome.

An unauthenticated attacker posts a blog comment whose author field or body contains a crafted attribute payload. After the comment is published and the plugin's HTML-rewriting option is active, the routine strips a quote that terminates an attribute in the rendered page, breaking out of the intended markup so the injected attribute runs JavaScript when any visitor - including a logged-in administrator - loads the front-end page. No public exploit was identified at time of analysis; the only linked advisory is the WPScan report.