Stored XSS in LiteSpeed Cache for WordPress via Comment Content

LiteSpeed Cache for WordPress, in versions up to and including 7.8.1, contains a high-severity Stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-18978). The flaw resides in the plugin's insufficient sanitization and output escaping of user-supplied comment content. Specifically, attackers can bypass the WordPress wp_kses sanitization function by crafting payloads using decimal numeric character references (e.g., HTML entities for quotes, brackets) placed inside allowed HTML elements like <code>.

Because wp_kses fails to recognize certain patterns as dangerous HTML attributes when nested within allowed elements, malicious scripts can persist in the comment database. These scripts execute in the context of the browser for any user (including administrators) who visits the page containing the injected comment. Successful exploitation requires a specific configuration where the WordPress site allows comments from previously approved users and has the "require_name_email" setting disabled.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browsers of site visitors or administrators. This can lead to session hijacking, unauthorized actions performed on behalf of the victim (such as creating new administrative users or modifying site content), and credential theft. The impact is significant for high-traffic WordPress sites that allow user comments, particularly if site administrators frequently visit comment-heavy pages.

Recommendation

• Update the LiteSpeed Cache plugin to the latest version immediately to remediate CVE-2026-18978.
• Audit WordPress site settings to enable "require_name_email" for comments to increase the friction for unauthenticated attackers.
• Review site comment moderation settings to ensure new comments from previously approved authors are held for review if the plugin update cannot be applied immediately.
• Monitor web server logs for suspicious HTTP POST requests to the WordPress comment submission endpoint (/wp-comments-post.php) containing HTML numeric entities or script-like patterns.