LiteSpeed Cache EUVD-2026-108600

Exploitation requires three concrete conditions drawn from the description: (1) the LiteSpeed Cache HTML optimization routine must be enabled on the site (it is this optimization that erroneously operates beyond stylesheet content and deletes the markup closing an attribute), (2) the attacker's comment must actually be published - so sites requiring manual comment moderation or disabling comments are not exposed via this path - and (3) a victim must view the affected front-end page while optimization is active, including a logged-in administrator (UI:R). The attacker needs no authentication (PR:N) since any user whose comment is published can inject. Limiting factors that reduce realistic risk: the optimization behavior is a configurable feature rather than guaranteed default, comment publication may be moderated, and the payload only fires on victim page view, which is why CVSS rates AC:H and SSVC marks it not automatable.

This is a stored cross-site scripting flaw (CWE-79) in the LiteSpeed Cache plugin before 7.9.2, with a vendor CVSS of 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). The signals are internally consistent and point to a real but conditional issue rather than a drop-everything emergency. The CVSS vector confirms network reach and no attacker authentication (PR:N - an unauthenticated user whose comment is published), but also AC:H and UI:R, meaning success depends on a specific non-default configuration and on a victim viewing the affected page. CISA's SSVC framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (it cannot be sprayed at scale because it needs the optimization enabled, a published comment, and victim interaction), while Technical Impact=total reflects that a successful hit against an administrator can lead to full account/site compromise. The vuln.today decision label is 'this_week', not act_now/emergency. This is NOT in CISA KEV and no EPSS score was provided, so I cannot quote an exploitation-probability figure. No public exploit was identified at the time of analysis; the only linked resource is the WPScan advisory, not verified working exploit code. Net assessment: a legitimately high-impact XSS against a very widely installed plugin, but gated by configuration and user interaction, so prioritize patching this week rather than treating it as active mass exploitation. The high C/I/A values in the vendor vector overstate availability impact for a browser-context XSS - verify impact framing against the vendor advisory.

An unauthenticated attacker posts a blog comment containing a crafted author field or comment body with an event-handler attribute payload. When LiteSpeed Cache's HTML optimization is enabled, the routine strips the markup that closes a preceding attribute so the injected event handler becomes live, and when an administrator or other visitor later loads that front-end page the attacker's JavaScript executes in their browser session. No public exploit code was identified at the time of analysis; the attack requires the optimization feature to be active and the target to view the page (UI:R).