LiteSpeed Cache 7.9.2 fixes two flaws in page optimisation

Q: Which LiteSpeed Cache settings make a site vulnerable?

Font Display Optimization under LiteSpeed Cache > Page Optimization > CSS Settings (CVE-2026-113500) and Use CDN Mapping under LiteSpeed Cache > CDN > Other Static CDN (CVE-2026-113499). Both are off by default, but the Advanced (Recommended), Aggressive and Extreme presets under LiteSpeed Cache > Presets turn Font Display Optimization on. A site is vulnerable if it runs a version before 7.9.2 with at least one of them on.

# TagsSecurityWordPress

The WPhost team27 Oct 20269 min read

On 23 October 2026 the US National Vulnerability Database (NVD) published two vulnerabilities in the LiteSpeed Cache plugin, CVE-2026-113500 and CVE-2026-113499. Every version before 7.9.2 is affected, and 7.9.2, released on 20 October, fixes both. They let someone without an account inject JavaScript into a page (an attack known as XSS) that then runs in the browser of every visitor, a logged-in administrator included. According to wordpress.org, the plugin has more than 7 million active installations.

The attack only works when one of two optimisation settings is switched on and the site publishes comments. One of those settings, though, is part of the Advanced preset that the plugin itself recommends, so it may be on without anyone having enabled it by hand.

What an attacker can do

Before a page goes out to a visitor, LiteSpeed Cache rewrites it so it loads faster. Two of those rewrites are meant to touch only the stylesheets (CSS), but in older versions they run over the whole HTML of the page. In certain cases one of them deletes the character that ends an attribute of an HTML tag and the other removes a quote, so the boundaries of the tag shift.

According to the CVE records, an attacker combines this with the comment author's name, which is printed on the page without proper escaping. They leave a comment under a crafted name. Once the comment is published, part of the name turns into an attribute that runs JavaScript when someone opens the page. The attacker needs no account on the site.

A script running in an ordinary visitor's browser could, for example, send them to another site. A script running in a logged-in administrator's browser can do anything that administrator can do in wp-admin, including creating a new user with full rights. CISA rates the technical impact as total.

Both vulnerabilities score 7.5 on the CVSS scale, "high". The attack complexity is rated high, and someone has to open the page for it to work. The CVSS score guide explains what such a score means. As of 23 October, CISA notes in the records that there is no evidence of attacks and that the attack cannot be automated. WPScan will publish the proof of concept on 22 November 2026, and from then on anyone can see how the attack works. Update before that date.

Which sites are affected

The plugin's full page cache needs a LiteSpeed server or QUIC.cloud, which is why LiteSpeed Cache is especially common on LiteSpeed hosting. Its page optimisations work on any server, Apache and nginx included, so sites hosted elsewhere can be affected too.

A site is vulnerable if it runs LiteSpeed Cache older than 7.9.2 with at least one of these settings switched on.

Font Display Optimization under LiteSpeed Cache > Page Optimization > CSS Settings (CVE-2026-113500). It tells the browser to show text in a fallback font while the real one loads. It is off by default, but the Advanced (Recommended), Aggressive and Extreme presets under LiteSpeed Cache > Presets turn it on.
Use CDN Mapping under LiteSpeed Cache > CDN > Other Static CDN (CVE-2026-113499). It makes the plugin swap the addresses of images and files for the CDN's address, including inside the styles embedded in the page. It is also off by default.

The attacker also needs a published comment. The records describe no other route, so a site with comments closed is less exposed. They do not say whether the escaping of the name depends on the theme, so treat any site with an old version and one of these settings on as vulnerable.

Is your site affected?

You can see the version under Plugins > Installed Plugins. In cPanel's Terminal, the command below shows the LiteSpeed Cache version and whether the plugin is active. The WP-CLI guide explains how to work with WP-CLI.

Bash

# cPanel > Terminal, in the site's folder
# Read-only. Shows the LiteSpeed Cache version.
wp plugin list --fields=name,status,version \
  --skip-plugins --skip-themes | grep -i litespeed

If the version is 7.9.2 or later, these two vulnerabilities are already closed. If it is older, open the two settings from the previous section. Font Display Optimization is on when the switch is set to Swap, and Use CDN Mapping when it is set to ON.

If either is on, look through the approved comments as well. The next command searches the author names for text such as onmouseover= or onfocus=, which is how JavaScript gets attached in HTML.

Bash

# cPanel > Terminal, in the site's folder
# Read-only. Approved comments with a suspicious author name.
wp comment list --status=approve \
  --fields=comment_ID,comment_post_ID,comment_author \
  --format=csv --skip-plugins --skip-themes \
  | grep -iE "on[a-z]+[[:space:]]*="

An empty result is a good sign, though not proof, because the details of the attack only become public on 22 November.

What to do

Back up the files and the database, as described in the backup guide. Version 7.9.2 is a large update. Besides the two fixes it changes a lot in caching and optimisation and removes the JS Delayed Includes setting. If you have a staging copy of the site, try the update there first.
Update LiteSpeed Cache to 7.9.2 or later from Dashboard > Updates or Plugins > Installed Plugins. Then open a few pages, the cart and the checkout and make sure everything works. The guide to updating plugins shows how to update without surprises.
Purge the cache. According to the 7.9.2 code, the plugin purges its own cache when it updates, but click Purge All in the LiteSpeed menu in the admin bar anyway. If another page cache sits in front of the site, such as QUIC.cloud CDN or a Cloudflare rule that caches HTML, purge that too, since it may still hold pages built by the old version.
If the check turns up a suspicious comment, do not open its page while you are logged in to wp-admin. Delete the comment under Comments, look through Users for administrators you do not recognise and change the administrators' passwords. If you find signs of a break-in, work through the guide for a hacked site.

What we do

With vulnerability (CVE) monitoring we track what is installed on your site and match it against the vulnerability (CVE) databases every day. As soon as a vulnerability appears in something you use, we send you an alert and update, trying the update on a copy in staging first. Your site can be hosted anywhere. If you would like us to add it, write to us through the inquiry form.

Frequently asked questions

Which vulnerabilities does LiteSpeed Cache 7.9.2 fix?

Two vulnerabilities, CVE-2026-113500 and CVE-2026-113499, published in the NVD on 23 October 2026. They let someone without an account inject JavaScript into a page (an attack known as XSS), which then runs in the browser of every visitor, a logged-in administrator included. Every version before 7.9.2 is affected, and 7.9.2 came out on 20 October 2026.

Is my site affected if it is not on a LiteSpeed server?

It may be. The full page cache in LiteSpeed Cache needs a LiteSpeed server or QUIC.cloud, but its page optimisations work on any server, Apache and nginx included. So sites on other hosting can be affected too.

Which LiteSpeed Cache settings make a site vulnerable?

Font Display Optimization under LiteSpeed Cache > Page Optimization > CSS Settings (CVE-2026-113500) and Use CDN Mapping under LiteSpeed Cache > CDN > Other Static CDN (CVE-2026-113499). Both are off by default, but the Advanced (Recommended), Aggressive and Extreme presets under LiteSpeed Cache > Presets turn Font Display Optimization on. A site is vulnerable if it runs a version before 7.9.2 with at least one of them on.

Does the LiteSpeed Cache attack need comments to be enabled?

Yes. The attacker leaves a comment under a crafted author name, and once the comment is published, part of the name becomes an attribute that runs JavaScript when the page is opened. The records describe no other route, so a site with comments closed is less exposed. They do not say whether the escaping of the name depends on the theme, so treat any site with an old version and one of the two settings on as vulnerable.

What can an attacker do with the LiteSpeed Cache vulnerability?

A script in an ordinary visitor's browser could, for example, send them to another site. A script in a logged-in administrator's browser can do anything that administrator can do in wp-admin, including creating a new user with full rights. Both vulnerabilities score 7.5 on CVSS, "high", and CISA rates the technical impact as total.

By when should I update LiteSpeed Cache?

Before 22 November 2026. On that date WPScan publishes the proof of concept, and anyone will be able to see how the attack works. As of 23 October, CISA notes in the records that there is no evidence of attacks and that the attack cannot be automated.

What should I check after updating to LiteSpeed Cache 7.9.2?

Version 7.9.2 is a large update that changes a lot in caching and optimisation and removes the JS Delayed Includes setting, so back up first. After the update, open a few pages, the cart and the checkout. Click Purge All in the LiteSpeed menu in the admin bar, and purge QUIC.cloud CDN or Cloudflare too if it caches HTML.

What if I cannot update LiteSpeed Cache right away?

Set Font Display Optimization to Default and Use CDN Mapping to OFF, then purge the cache. Text may appear a little later, and images will load from your own server. Another stopgap is to tick Comment must be manually approved under Settings > Discussion and not approve comments with odd names, but neither replaces the update.

Sources