Description

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A comment payload crafted exclusively from decimal numeric character references (e.g. ", <, >) placed inside an allowed element such as <code> bypasses WordPress's wp_kses sanitization, as kses does not treat a data-settings="..." substring within text content as an HTML attribute, allowing the malicious payload to reach the vulnerable function. For this to be exploitable, the site must allow users with previously approved comments to write new comments, and the require_name_email setting must be disabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-28T05:16:41.927Z",
  "pubdate": "2026-08-28T05:16:41.927Z",
  "executiveSummary": "The LiteSpeed Cache plugin for WordPress contains a critical Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 7.8.1.\nThe vulnerability originates from insufficient input sanitization and output escaping within the comment processing logic.\nUnauthenticated attackers can inject malicious web scripts into comment fields, which execute when an administrator or user views the compromised page.\nExploitation requires specific site configurations, namely that the site allows users with previously approved comments to post without moderation and has the 'require_name_email' setting disabled.\nIf successful, the vulnerability allows for unauthorized script execution in the context of the victim's session, potentially leading to account takeover, unauthorized actions, or session hijacking.\nThis vulnerability is classified as a high-risk security flaw because it bypasses standard WordPress protection mechanisms (wp_kses) through the use of decimal numeric character references.\nOrganizations relying on the LiteSpeed Cache plugin should prioritize updating to a secure version or enforcing strict moderation policies on comments to mitigate the threat vector.",
  "technicalDetails": "The vulnerability in LiteSpeed Cache stems from a bypass of the WordPress 'wp_kses' filtering mechanism. The plugin fails to adequately sanitize input content before it is stored in the database and subsequently rendered in the browser. The root cause is a flaw in how the plugin handles specific strings, specifically failing to recognize malicious payloads when wrapped in decimal numeric character references (e.g., &#34;, &#60;, &#62;).\nUnder normal circumstances, 'wp_kses' filters out potentially dangerous HTML tags and attributes to prevent XSS. However, the plugin logic does not correctly handle 'data-settings' substrings when placed inside allowed elements such as '<code>' tags. By nesting an obfuscated payload inside a legitimate HTML element using decimal encoding, the attacker causes the sanitization engine to treat the payload as benign text content rather than executable HTML attributes.\nThe attack flow proceeds as follows: First, the attacker identifies a WordPress site using the vulnerable LiteSpeed Cache version where the 'require_name_email' setting is disabled and comment moderation is set to automatically approve subsequent comments from users with a prior history. Second, the attacker crafts a malicious payload consisting of decimal numeric character references that resolve to executable JavaScript when decoded by the browser. Third, the attacker submits this payload via the comment form. Because the filter bypasses the security checks, the raw or partially decoded payload is committed to the database. Finally, when a user—typically an administrator with higher privileges—views the page containing the comment, the browser interprets the injected character references as active HTML attributes or script tags, executing the arbitrary JavaScript.\nThis vulnerability is particularly dangerous because it allows for unauthenticated remote code execution in the victim's browser context. The impact post-exploitation includes the ability to perform actions on behalf of the logged-in user, such as changing administrative passwords, creating new administrative accounts, or injecting further malicious content into the site's front-end or back-end interface. The vulnerability exists because the application output does not properly encode content, allowing the browser to misinterpret data as executable instructions."
}