LiteSpeed Cache CVE-2026-18978

Two explicit site-level conditions must both be true simultaneously: (1) The commenting system must allow users whose comments have previously been approved to post new comments without moderation (i.e., WordPress's 'Comment author must have a previously approved comment' trust setting is active and the attacker's identity has a prior approval on the target site). (2) The require_name_email setting must be disabled, removing the name-and-email gating that would otherwise add friction to unauthenticated submission. If either condition is absent - if comments require moderation for all users, or if name/email is required - the attack path is blocked. Exploitation is further limited to WordPress installations running LiteSpeed Cache version 7.8.1 or earlier; sites on 7.9+ are not affected. No server-side access, WordPress account, or administrative privilege is required by the attacker once both pre-conditions are met.

The provided CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N yields a base score of 7.2, but several metrics warrant scrutiny. PR:N and AC:L overstate accessibility: exploitation requires two distinct non-default pre-conditions (prior comment approval for the attacker's account AND require_name_email disabled), which the CVSS AC:L label does not capture. UI:N is also arguable - stored XSS canonically requires a victim to browse to the injected page, which most CVSS assessors score as UI:R. Real-world risk is meaningful but bounded: WordPress sites with comment approval workflows enabled and require_name_email turned off are common in community-oriented deployments, meaning even a mid-sized municipal IT team in leszno running a public-facing WordPress site could be exposed if they rely on LiteSpeed Cache and have not hardened comment settings. No EPSS score was provided in the input, and CISA KEV status is absent - exploitation probability must be inferred from structural signals rather than empirical data. The scope-changed flag (S:C) is credible given that a single stored payload can execute across all visitor sessions. The net assessment is moderate-to-high priority for sites matching the exploitation conditions, but not a universal emergency given the prerequisite configuration state.

An attacker identifies a WordPress site running LiteSpeed Cache 7.8.1 or earlier with require_name_email disabled and a comment section where a prior comment from their email address has already been approved. They submit a new comment containing a <code> element whose text content encodes a malicious script tag entirely as decimal numeric character references; wp_kses passes the content as safe text, and LiteSpeed Cache's media.cls.php renders it without re-encoding. Every authenticated visitor - including administrators - who subsequently loads the affected page executes the injected script, enabling session cookie theft or admin-level actions via the victim's credentials.