LiteSpeed Cache for WordPress: XSS patch CVE-2026-76579, upgrade to 7.9.1

LiteSpeed Technologies published a security advisory on 18 September 2026 for the LiteSpeed Cache for WordPress plugin (LSCWP), reporting a Cross-Site Scripting vulnerability that has been patched in version 7.9.1. For those running WordPress hosting on LiteSpeed stacks, this matters because the plugin is installed on a very large number of sites, often pre-activated by hosting provider control panels.

The vulnerability

According to the official LiteSpeed blog, the flaw was reported by the Wordfence team and assigned the CVE identifier CVE-2026-76579. It is an XSS vulnerability that affects only sites where all of the following conditions are true:

• Cache > Cache > Enable Cache set to ON
• Cache > ESI > Enable ESI set to ON
• the site has at least one published post with comments enabled

With this configuration, an unauthenticated attacker can trick a visitor into opening a malicious page. Opening the page causes JavaScript controlled by the attacker to execute with the visitor's permissions, including any administrator permissions if the victim is logged in. No account on the target site is required; only that the victim visits the attacker's page.

Timeline

• 19 August 2026: Wordfence reports the issue to LiteSpeed
• 1 September 2026: LiteSpeed releases the patch in version 7.9.1 on the WordPress repository
• 4 September 2026: version 7.9.1 is added to the list of stable releases in the LiteSpeed control panel

What to do

LiteSpeed recommends upgrading every site to version 7.9.1 or later of the plugin. Anyone keeping LSCWP up to date has nothing more to do; anyone who hasn't updated for a while should do so immediately, checking in particular sites with Enable Cache and Enable ESI active and comments enabled on published posts.

Source: official LiteSpeed blog, https://blog.litespeedtech.com/2026/09/18/security-update-for-lscwp-cve-2026-76579/