Back to Security Advisories

LiteSpeed CVE-2026-18978: Cross-Site Scripting (XSS)

High 7.2 CVSS
LiteSpeed

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a vulnerability in LiteSpeed software, not in licensing. Licenses continue to work during and after the update; there is no need to re-issue or re-activate anything. If you resell LiteSpeed under your own brand, patch client servers too — unpatched installs put your reputation at risk, not your license.

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A comment payload crafted exclusively from decimal numeric character references (e.g. “, <, >) placed inside an allowed element such as <code> bypasses WordPress’s wp_kses sanitization, as kses does not treat a data-settings=”…” substring within text content as an HTML attribute, allowing the malicious payload to reach the vulnerable function. For this to be exploitable, the site must allow users with previously approved comments to write new comments, and the require_name_email setting must be disabled.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-18978

Frequently Asked Questions

What is CVE-2026-18978?
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A comment payload crafted exclusively from decimal numeric character references (e.g. ", <, >) placed inside an allowed element such as <code> bypasses WordPress's wp_kses sanitization, as kses does not treat a data-settings="..." substring within text content as an HTML attribute, allowing the malicious payload to reach the vulnerable function. For this to be exploitable, the site must allow users with previously approved comments to write new comments, and the require_name_email setting must be disabled.
Is CVE-2026-18978 being exploited in the wild?
No confirmed exploitation has been announced. Patch on your normal schedule and watch the vendor advisory for updates.
How do I fix CVE-2026-18978?
Update LiteSpeed to the patched release.Then confirm the running version matches the patched release listed above.

References

Security Advisories

Related Advisories

LiteSpeed CVE-2026-93903

2026-09-30 00:00:00

LiteSpeed Cache for WordPress CVE-2026-76579: Reflected Cross-Site Scripting (XSS)

2026-09-19

Security Advisory: LiteSpeed Web Server Enterprise 6.3.7 or later is required

2026-09-18

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System