Back to Security Advisories

LiteSpeed Cache for WordPress CVE-2026-76579: Reflected Cross-Site Scripting (XSS)

LiteSpeed Cache for WordPress is affected by CVE-2026-76579. The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and. Affected versions: all versions up to and including 7.9. CVSS base score: 4.7.

Medium 4.7 CVSS
LiteSpeed WordPress

Affected Versions

all versions up to and including 7.9

Default Update CMD

wp plugin update litespeed-cache

Fix Commands

All supported operating systems

wp plugin update litespeed-cache
# or: WordPress → Plugins → LiteSpeed Cache → Update Now
wp plugin get litespeed-cache --field=version

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a vulnerability in LiteSpeed Cache for WordPress (a free WordPress plugin), not in licensing. No license action is needed; update the plugin to protect the sites running on your servers.

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘esi’ parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the attacker supply a validly signed ‘esi’ value in the GET query string while submitting a separate attacker-controlled ‘esi’ payload as a POST body field, relying on PHP’s default $_REQUEST merge order to have the POST value take precedence at the point of execution.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-76579

Frequently Asked Questions

What is CVE-2026-76579?
The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and. Affected versions: all versions up to and including 7.9.
Is CVE-2026-76579 being exploited in the wild?
No confirmed public exploitation has been announced at the time of writing. With a CVSS base score of 4.7, apply the update on your next maintenance window and watch the vendor advisory for changes.
How do I fix CVE-2026-76579?
wp plugin update litespeed-cache. or: WordPress → Plugins → LiteSpeed Cache → Update Now. wp plugin get litespeed-cache --field=version.
Which versions are affected?
Affected: all versions up to and including 7.9. Update to the latest release.

References

Security Advisories

Related Advisories

LiteSpeed CVE-2026-93903

2026-09-30 00:00:00

WordPress 7.1.2 Release

2026-09-22

Security Advisory: LiteSpeed Web Server Enterprise 6.3.7 or later is required

2026-09-18

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System