LiteSpeed Cache CVE-2026-116763

Exploitation requires two specific conditions stated in the description: the LiteSpeed Cache HTML Minify option (O_OPTM_HTML_MIN) must be enabled, AND a companion plugin must render the stored comment content into a raw-text context such as a JSON-LD script block on the same page. Without both, the injected payload is not placed into an executable context. The injection point is the 'comment' parameter and does not require authentication (PR:N), but these non-default configuration requirements - plus dependence on a secondary plugin's output behavior - are the primary factors limiting real-world exploitability and underpin the AC:H rating. Affected: all LiteSpeed Cache versions up to and including 7.9.1.

This is a moderate-severity Stored XSS (CVSS 5.4) that is realistically lower-priority than the CVSS score alone might suggest, because exploitation is heavily conditional. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) shows a network, unauthenticated vector but explicitly flags high attack complexity (AC:H) and a scope change (S:C) reflecting script execution in a victim's browser rather than on the server. The AC:H is corroborated by the description: the flaw is only reachable when the HTML Minify option (O_OPTM_HTML_MIN) is enabled AND a companion plugin renders stored comment content into a raw-text context such as a JSON-LD script block on the same page. No EPSS score is provided in the input, there is no CISA KEV listing, and no confirmed public exploit code is present - the references are the Wordfence advisory, plugin source lines, and the fix changeset, not a working PoC. The vuln.today decision label is 'this_month', consistent with a real but non-emergency issue. Net assessment: a genuine unauthenticated stored-XSS requiring a specific, non-default configuration plus a secondary plugin - prioritize patching on a normal cycle rather than as an emergency, with urgency raised for sites known to run HTML Minify alongside a JSON-LD/structured-data plugin.

An unauthenticated attacker submits a comment containing a crafted script payload to a WordPress site running LiteSpeed Cache with HTML Minify enabled. If a companion plugin writes that stored comment text into a raw-text context such as a JSON-LD script block on a cached page, the injected script executes in the browser of any visitor who loads that page, enabling session theft or actions in the victim's context. No public exploit code is identified in the provided data; exploitation also depends on the specific HTML Minify plus companion-plugin combination, consistent with the AC:H rating.