CVE-2026-18978
Received Received - Intake

Stored XSS in LiteSpeed Cache WordPress Plugin

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: Wordfence

Description
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A comment payload crafted exclusively from decimal numeric character references (e.g. ", <, >) placed inside an allowed element such as <code> bypasses WordPress's wp_kses sanitization, as kses does not treat a data-settings="..." substring within text content as an HTML attribute, allowing the malicious payload to reach the vulnerable function. For this to be exploitable, the site must allow users with previously approved comments to write new comments, and the require_name_email setting must be disabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-18978
EUVD
EUVD-2026-67404

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lwiespeed cache to 7.8.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The LiteSpeed Cache plugin for WordPress has a stored cross-site scripting (XSS) vulnerability due to improper input sanitization and output escaping. Attackers can inject malicious scripts via comment content using decimal numeric character references (e.g., &#34;, &#60;, &#62;) in allowed elements like <code>. These scripts execute when users access infected pages. Exploitation requires sites allowing users with approved comments to post new ones and having the require_name_email setting disabled.

Detection Guidance

Check for the LiteSpeed Cache plugin version 7.8.1 or lower. Inspect WordPress comments for payloads using decimal numeric character references like &#34; or &#60; within allowed elements such as <code>. Review plugin settings to confirm if require_name_email is disabled and if users with approved comments can post new ones.

Impact Analysis

Unauthenticated attackers could inject malicious scripts into your WordPress site via comments. These scripts may steal user data, hijack sessions, or deface pages. If your site allows comments from previously approved users and lacks name/email requirements, it is at higher risk of exploitation.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. A successful exploit may result in data breaches, triggering compliance violations and potential fines.

Mitigation Strategies

Update the LiteSpeed Cache plugin to the latest version beyond 7.8.1. Enable require_name_email in WordPress settings to restrict comment posting. Review and remove any suspicious comments containing decimal numeric character references. Consider disabling comment functionality temporarily if not essential.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18978. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart