Back to Security Advisories

LiteSpeed CVE-2026-113499

CVE-2026-113499 (7.5 in the advisory's data) affects LiteSpeed versions before 7.9.2: does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the. Update to 7.9.2 or later to close it.

High 7.5 CVSS

What this means under a SharedLicense license

An attacker who reaches the affected component can gain the outcomes implied by CWE-79 — patch rather than mitigate.

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-113499

Frequently Asked Questions

What is CVE-2026-113499?
does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the — affects versions before 7.9.2.
What version fixes it?
7.9.2 or later.
How urgent is it?
The advisory's own severity data: CVSS 7.5 — patch promptly.

References

Security Advisories

Related Advisories

Linux Kernel (HWE) Vulnerabilities — Ubuntu Security Update (USN-9018-2)

2026-11-12

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System