LiteSpeed Cache for WordPress CVE-2026-76579: Reflected Cross-Site Scripting (XSS)

LiteSpeed Cache for WordPress is affected by CVE-2026-76579. The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and. Affected versions: all versions up to and including 7.9. CVSS base score: 4.7.

Medium 4.7 CVSS 2026-09-19 सत्यापित 2026-09-24

LiteSpeed WordPress

प्रभावित संस्करण

all versions up to and including 7.9

डिफ़ॉल्ट अपडेट कमांड

wp plugin update litespeed-cache

सुधार कमांड

All supported operating systems

wp plugin update litespeed-cache
# or: WordPress → Plugins → LiteSpeed Cache → Update Now
wp plugin get litespeed-cache --field=version

SharedLicense लाइसेंस के तहत इसका अर्थ

Your SharedLicense license itself is not affected — this is a vulnerability in LiteSpeed Cache for WordPress (a free WordPress plugin), not in licensing. No license action is needed; update the plugin to protect the sites running on your servers.

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘esi’ parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the attacker supply a validly signed ‘esi’ value in the GET query string while submitting a separate attacker-controlled ‘esi’ payload as a POST body field, relying on PHP’s default $_REQUEST merge order to have the POST value take precedence at the point of execution.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-76579

अक्सर पूछे जाने वाले प्रश्न

What is CVE-2026-76579?

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and. Affected versions: all versions up to and including 7.9.

Is CVE-2026-76579 being exploited in the wild?

No confirmed public exploitation has been announced at the time of writing. With a CVSS base score of 4.7, apply the update on your next maintenance window and watch the vendor advisory for changes.

How do I fix CVE-2026-76579?

wp plugin update litespeed-cache. or: WordPress → Plugins → LiteSpeed Cache → Update Now. wp plugin get litespeed-cache --field=version.

Which versions are affected?

Affected: all versions up to and including 7.9. Update to the latest release.

संदर्भ

सुरक्षा सलाह

अपने सिस्टम में भेद्यताओं की जाँच करें

अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।

अपना सिस्टम जाँचें

All supported operating systems

अक्सर पूछे जाने वाले प्रश्न

संबंधित सलाह

अपने सिस्टम में भेद्यताओं की जाँच करें