# CVE-2026-116763: LiteSpeed Cache for WordPress stored XSS in HTML minification

Source: https://junglewise.ai/threats/cve-2026-116763-the-litespeed-cache-plugin-for-wordpress-is-vulnerable-to-stored  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-116763 · Severity: medium · CVSS 5.4 · Published 2026-10-29

The LiteSpeed Cache plugin for WordPress, used to optimize website performance, contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into web pages. When the HTML Minify feature is enabled and a companion plugin renders comments in raw text contexts like JSON-LD blocks, these scripts execute for all users visiting the affected page, enabling credential theft or malware distribution.

Technologies: [LiteSpeed Cache for WordPress](https://junglewise.ai/threats/technologies/cache-for-wordpress). Vendors: [LiteSpeed](https://junglewise.ai/threats/vendors/litespeed).

## Quick answers

**Is CVE-2026-116763 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116763 being exploited in the wild.

**How severe is CVE-2026-116763?** Medium severity, with a CVSS score of 5.4, published 29 October 2026.

**Which products and versions are affected?** LiteSpeed Cache for WordPress up to and including 7.9.1.

**Is there a fix for CVE-2026-116763?** No fixed version is recorded yet. Disable the HTML Minify option (O_OPTM_HTML_MIN) until a patched version is available, or avoid using companion plugins that render comment content into raw-text script contexts. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116763 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116763?** Check whether you run LiteSpeed Cache for WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable the HTML Minify option (O_OPTM_HTML_MIN) until a patched version is available, or avoid using companion plugins that render comment content into raw-text script contexts.

## Technical details

Stored XSS in the 'comment' parameter due to insufficient input sanitization and output escaping in the HTML minification component. The vulnerability requires both the HTML Minify option (O_OPTM_HTML_MIN) to be enabled and a companion plugin that renders stored comments into raw-text script contexts. An unauthenticated attacker can inject arbitrary JavaScript that persists in the database and executes in users' browsers.

## Affected products

- LiteSpeed Cache for WordPress up to and including 7.9.1

## Timeline

- 2026-10-29: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/lib/html-min.cls.php](https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/lib/html-min.cls.php)
- [https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/lib/html-min.cls.php](https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/lib/html-min.cls.php)

## Related threats

- [LiteSpeed Cache for WordPress stored cross-site scripting in image attributes](https://junglewise.ai/threats/cve-2026-3129-litespeed-cache-for-wordpress-stored-cross-site-scripting-in-image)