LiteSpeed Cache for WordPress: three flaws patched in version 7.9.2

LiteSpeed Technologies has released version 7.9.2 of LiteSpeed Cache for WordPress (LSCWP), the server-level cache plugin that according to its official wordpress.org page has over 7 million active installations. The update addresses three recently disclosed vulnerabilities, two of which can be exploited without authentication.

The three CVEs

LiteSpeed Cache for WordPress (LSCWP) is a site acceleration plugin with server-level cache features and exclusive optimisations. The patched flaws are:

• CVE-2026-113499 and CVE-2026-113500: cross-site scripting. A site is vulnerable only if it accepts comments and publishes a comment from an unauthenticated visitor without the theme escaping the author name. CVE-2026-113499 additionally requires the options CDN > Other Static CDN > Use CDN Mapping, a CDN URL defined and Include Images to be enabled; CVE-2026-113500 requires Page Optimization > CSS Settings > Font Display Optimization to be set to Swap. If these conditions are met, an attacker without an account can execute a script in the browser of anyone visiting the page, and if the visitor is a logged-in administrator the script runs with their permissions.
• CVE-2026-113501: missing authorisation. An account with at least Subscriber role – obtainable on any site with user registration open – can delete admin notices pinned by the plugin, preventing the site owner from seeing a warning they would otherwise have acted on. The issue does not permit data access, code execution or account takeover.

Timeline and required action

LiteSpeed patched the issue and released version 7.9.2 to the WordPress repository on 19 October 2026, with one week's notice from disclosure. On 23 October 2026, version 7.9.2 was added to the list of stable releases in the plugin section of the company's control panel.

Those with automatic plugin updates enabled need take no action. For those who have not yet updated, the recommended action is to update immediately to LSCache 7.9.2 or later. As a temporary mitigation against the two XSS flaws while awaiting the update, you can enable comment moderation.

OpenLiteSpeed is not a Prime Software product.