Description

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the attacker supply a validly signed 'esi' value in the GET query string while submitting a separate attacker-controlled 'esi' payload as a POST body field, relying on PHP's default $_REQUEST merge order to have the POST value take precedence at the point of execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-19T09:16:34.443Z",
  "pubdate": "2026-09-19T09:16:34.443Z",
  "executiveSummary": "The LiteSpeed Cache plugin for WordPress is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability. This security flaw stems from inadequate input sanitization and output escaping mechanisms within the 'esi' parameter handling logic.\nThe vulnerability allows unauthenticated remote attackers to inject and execute arbitrary JavaScript code within the context of a victim's browser session. By manipulating the 'esi' parameter, an attacker can execute malicious scripts if they successfully induce a user to interact with a crafted URL.\nThis vulnerability affects all versions of the LiteSpeed Cache plugin up to and including version 7.9. The risk is significant, as successful exploitation can lead to unauthorized actions performed on behalf of the user, session hijacking, or the theft of sensitive session cookies.\nExploitation requires a two-part approach: providing a validly signed 'esi' value in the GET request and an attacker-controlled payload in the POST body. Because PHP's $_REQUEST superglobal merges these values, the POST data overwrites the GET data, allowing the malicious payload to be processed by the server-side logic.",
  "technicalDetails": "The core vulnerability resides in the improper handling of the 'esi' (Edge Side Includes) parameter within the LiteSpeed Cache plugin. The plugin fails to perform rigorous validation on the input received via the 'esi' parameter before reflecting it back to the client-side environment. This lack of sanitization and context-aware output encoding provides an injection vector for malicious web scripts.\nThe exploit mechanism leverages the behavior of PHP's $_REQUEST superglobal. By default, when identical parameter names are present in both the GET query string and the POST body, the configuration of the PHP environment dictates that the POST data takes precedence over the GET data during the merge process. An attacker can craft an exploit by including a legitimately signed 'esi' value in the GET query string to bypass initial signature validation checks, while simultaneously injecting a malicious payload into the 'esi' parameter within the POST body.\nThe attack flow proceeds as follows: First, the attacker identifies a target site running an affected version (up to 7.9) of the LiteSpeed Cache plugin. Second, the attacker generates a malicious payload containing JavaScript code. Third, the attacker constructs a request that includes the validly signed 'esi' string in the GET parameters to satisfy the server's security checks. Fourth, the attacker includes the malicious payload in the POST body under the same 'esi' key. Upon submission, the server processes the request, and the $_REQUEST merge logic prioritizes the malicious POST payload. The application then reflects this unsanitized input into the rendered page response.\nWhen a victim interacts with this crafted request—often facilitated by tricking the user into clicking a malicious link—the victim's browser interprets the injected JavaScript as legitimate code from the trusted origin. This leads to the execution of the payload within the victim's session. The post-exploitation impact includes, but is not limited to, unauthorized access to user accounts, session token exfiltration, defacement of the rendered page, and the potential redirection of the user to malicious third-party domains. Since the vulnerability is reflected, the attack requires the victim's interaction, but the unauthenticated nature of the initial injection request makes it highly accessible for widespread automated or targeted attacks."
}