CVE-2026-76579

Received Received - Intake

Reflected Cross-Site Scripting in LiteSpeed Cache WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the attacker supply a validly signed 'esi' value in the GET query string while submitting a separate attacker-controlled 'esi' payload as a POST body field, relying on PHP's default $_REQUEST merge order to have the POST value take precedence at the point of execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-76579

Affected Vendors & Products

Vendor	Product	Version / Range
lwies	lite_speed_cache	to 7.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The LiteSpeed Cache plugin for WordPress has a reflected cross-site scripting (XSS) vulnerability due to insufficient input sanitization and output escaping in the 'esi' parameter. This allows unauthenticated attackers to inject malicious scripts into web pages. Exploitation requires tricking a user into clicking a link while the attacker submits a valid 'esi' value and a malicious payload via POST.

Detection Guidance

Check WordPress sites using the LiteSpeed Cache plugin for versions up to 7.9. Inspect GET/POST requests containing the 'esi' parameter for suspicious payloads. Look for unusual script execution in pages served by the plugin.

Impact Analysis

An attacker could steal user sessions, redirect users to malicious sites, or perform actions on their behalf. Users might unknowingly execute harmful scripts, leading to data theft or account compromise if they interact with a crafted link.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using the plugin may face compliance breaches if user data is compromised through exploitation.

Mitigation Strategies

Update the LiteSpeed Cache plugin to the latest version beyond 7.9. If immediate update is not possible, disable the plugin temporarily or add input sanitization for the 'esi' parameter via server-side rules.

Hi! I’m here to help you understand CVE-2026-76579. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70