Вернуться к предупреждениям о безопасности

LiteSpeed Cache for WordPress CVE-2026-76579: Reflected Cross-Site Scripting (XSS)

LiteSpeed Cache for WordPress is affected by CVE-2026-76579. The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and. Affected versions: all versions up to and including 7.9. CVSS base score: 4.7.

Medium 4.7 CVSS
LiteSpeed WordPress

Затронутые версии

all versions up to and including 7.9

Команда обновления по умолчанию

wp plugin update litespeed-cache

Команды исправления

All supported operating systems

wp plugin update litespeed-cache
# or: WordPress → Plugins → LiteSpeed Cache → Update Now
wp plugin get litespeed-cache --field=version

Что это значит по лицензии SharedLicense

Your SharedLicense license itself is not affected — this is a vulnerability in LiteSpeed Cache for WordPress (a free WordPress plugin), not in licensing. No license action is needed; update the plugin to protect the sites running on your servers.

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘esi’ parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the attacker supply a validly signed ‘esi’ value in the GET query string while submitting a separate attacker-controlled ‘esi’ payload as a POST body field, relying on PHP’s default $_REQUEST merge order to have the POST value take precedence at the point of execution.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-76579

Часто задаваемые вопросы

What is CVE-2026-76579?
The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and. Affected versions: all versions up to and including 7.9.
Is CVE-2026-76579 being exploited in the wild?
No confirmed public exploitation has been announced at the time of writing. With a CVSS base score of 4.7, apply the update on your next maintenance window and watch the vendor advisory for changes.
How do I fix CVE-2026-76579?
wp plugin update litespeed-cache. or: WordPress → Plugins → LiteSpeed Cache → Update Now. wp plugin get litespeed-cache --field=version.
Which versions are affected?
Affected: all versions up to and including 7.9. Update to the latest release.

Источники

Предупреждения о безопасности

Похожие предупреждения

LiteSpeed CVE-2026-93903

2026-09-30 00:00:00

WordPress 7.1.2 Release

2026-09-22

Security Advisory: LiteSpeed Web Server Enterprise 6.3.7 or later is required

2026-09-18

Проверьте систему на уязвимости

Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

Проверьте свою систему