LITESPEED Cache has three newly disclosed vulnerabilities affecting WordPress sites, with the issues tracked under CVEs 2026-113499, 2026-113500 and 2026-113501. The flaws were disclosed by WPScan on 23 October 2026 and patched in LiteSpeed Cache 7.9.2, released on 20 October 2026. The two stored XSS flaws can be triggered by unauthenticated commenters when the plugin’s HTML optimisation process is enabled, potentially running JavaScript in the browser of an administrator or other visitors. The third flaw involves a non‑restrictive capability check that could allow a Subscriber to dismiss non‑dismissible security notices.
Evidence and impact details indicate that both CVE-2026-113499 (Unauthenticated Stored XSS via CDN Inline CSS Rewriting) and CVE-2026-113500 (Unauthenticated Stored XSS via Font Display Optimization) can manifest through user‑generated comments, provided the optimisation feature is active. The CVE-2026-113501 issue (Subscriber+ Pinned Administrative Notice Dismissal) could enable a low‑privilege user to dismiss warnings about sensitive files.
At present, no exploitation in the wild is reported, and no CVSS scores are published; a proof‑of‑concept is expected to be released on 22 November 2026 to assist verification.
Affected versions are all LiteSpeed Cache releases prior to 7.9.2. Organisations should update to 7.9.2 or later, hold new comments for moderation until patching, and review recent comments and admin accounts for unusual activity.