LiteSpeed Cache for WordPress (LSCWP) 7.9.2 fixes three vulnerabilities: two unauthenticated cross-site scripting bugs, CVE-2026-113499 and CVE-2026-113500, and a missing-authorization bug, CVE-2026-113501. Every version before 7.9.2 is affected. LiteSpeed released 7.9.2 to the WordPress repository on 19 October 2026 and added it to the stable list in the control panel plugins on 23 October.
This is the second LSCWP security release in two months, after the CVE-2026-84761 SSRF fix in 7.9.1. If you only patched to 7.9.1, you're still exposed.
Who is exposed
The two XSS bugs share a root cause: an HTML optimisation path can break attribute quoting, so a malicious comment author name turns into script on the page. A site is exposed only if all of these hold:
- It accepts comments, and a comment from an unauthenticated visitor gets published.
- The theme (or other code) prints the comment author's name without escaping it.
- One of these LSCWP settings is on:
- CVE-2026-113499: CDN → Other Static CDN → Use CDN Mapping on, a CDN URL defined, and Include Images on.
- CVE-2026-113500: Page Optimization → CSS Settings → Font Display Optimization
set to
Swap.
When it fires, the script runs in the browser of anyone viewing the page. If that's a logged-in administrator, it runs with admin rights, which on WordPress usually means plugin installs and full site takeover.
CVE-2026-113501 needs an account with at least the Subscriber role. It lets that user dismiss the plugin's pinned admin notices, hiding warnings from the site owner. LiteSpeed says it exposes no data and allows no code execution. On sites with open registration, treat any visitor as a Subscriber.
LiteSpeed and the reporting coverage cite no in-the-wild exploitation as of 23 October. A public proof of concept is reportedly scheduled for 22 November, so finish patching before then.
Patch a single site
wp plugin update litespeed-cache
wp plugin get litespeed-cache --field=version
The second command should print 7.9.2 or later.
Patch a cPanel fleet with lscmctl
On LiteSpeed Enterprise servers with the WHM plugin, lscmctl upgrades every
discovered install in one pass. Set the active version first, then rescan and upgrade:
cd /usr/local/lsws/admin/misc
./lscmctl setversion --latest
./lscmctl setversion
./lscmctl scan -n
./lscmctl upgrade -m
setversion with no argument confirms the active version is 7.9.2 or later before you
push it. scan -n picks up installs added since the last scan. The WHM plugin's
Version Manager screen does the same from the GUI. If you'd rather leave updates to
Softaculous, check that its auto-upgrade policy
covers plugins on those installs.
Then verify. This catches installs lscmctl never discovered:
find /home*/*/public_html -path '*/plugins/litespeed-cache/litespeed-cache.php' \
-exec grep -H '^ \* Version:' {} \; | grep -v '7\.9\.[2-9]'
Anything it prints is still unpatched.
If you can't update today
Turn on comment moderation, so no anonymous comment gets published without review:
wp option update comment_moderation 1
Alternatively, switch off the CDN Mapping and Font Display Swap settings on affected
sites. Neither step fixes CVE-2026-113501. A WAF with WordPress virtual patching
also helps against stored XSS payloads, but don't rely on it alone.
Next steps
- Enable LSCache for WordPress on cPanel
- Find WordPress persistence after a cleanup
- LiteSpeed license tiers explained, or get a LiteSpeed license