Zurück zu den Sicherheitshinweisen

LiteSpeed Cache for WordPress CVE-2026-76579: Reflected Cross-Site Scripting (XSS)

LiteSpeed Cache for WordPress is affected by CVE-2026-76579. The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and. Affected versions: all versions up to and including 7.9. CVSS base score: 4.7.

Medium 4.7 CVSS
LiteSpeed WordPress

Betroffene Versionen

all versions up to and including 7.9

Standard-Update-Befehl

wp plugin update litespeed-cache

Fix-Befehle

All supported operating systems

wp plugin update litespeed-cache
# or: WordPress → Plugins → LiteSpeed Cache → Update Now
wp plugin get litespeed-cache --field=version

Was das unter einer SharedLicense-Lizenz bedeutet

Your SharedLicense license itself is not affected — this is a vulnerability in LiteSpeed Cache for WordPress (a free WordPress plugin), not in licensing. No license action is needed; update the plugin to protect the sites running on your servers.

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘esi’ parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the attacker supply a validly signed ‘esi’ value in the GET query string while submitting a separate attacker-controlled ‘esi’ payload as a POST body field, relying on PHP’s default $_REQUEST merge order to have the POST value take precedence at the point of execution.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-76579

Häufig gestellte Fragen

What is CVE-2026-76579?
The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and. Affected versions: all versions up to and including 7.9.
Is CVE-2026-76579 being exploited in the wild?
No confirmed public exploitation has been announced at the time of writing. With a CVSS base score of 4.7, apply the update on your next maintenance window and watch the vendor advisory for changes.
How do I fix CVE-2026-76579?
wp plugin update litespeed-cache. or: WordPress → Plugins → LiteSpeed Cache → Update Now. wp plugin get litespeed-cache --field=version.
Which versions are affected?
Affected: all versions up to and including 7.9. Update to the latest release.

Referenzen

Sicherheitshinweise

Verwandte Warnhinweise

LiteSpeed CVE-2026-93903

2026-09-30 00:00:00

WordPress 7.1.2 Release

2026-09-22

Security Advisory: LiteSpeed Web Server Enterprise 6.3.7 or later is required

2026-09-18

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen