CVE-2026-18978 Overview
CVE-2026-18978 is a stored Cross-Site Scripting (XSS) vulnerability in the LiteSpeed Cache plugin for WordPress. The flaw affects all versions up to and including 7.8.1. Unauthenticated attackers can inject arbitrary web scripts through comment content that executes when users view the affected page. The vulnerability stems from insufficient input sanitization and output escaping [CWE-79]. Exploitation requires the site to allow users with previously approved comments to post new comments, and the require_name_email setting must be disabled.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript payloads into WordPress pages, enabling session hijacking, credential theft, and administrative account takeover when administrators view affected content.
Affected Products
- LiteSpeed Cache plugin for WordPress — all versions through 7.8.1
- WordPress sites permitting comments from previously approved commenters
- WordPress installations with require_name_email disabled
Discovery Timeline
- 2026-08-28 - CVE-2026-18978 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-18978
Vulnerability Analysis
The LiteSpeed Cache plugin processes comment content in a way that reintroduces stored XSS after WordPress's core sanitization pipeline runs. The vulnerable code paths reside in src/media.cls.php at approximately lines 777, 1317, 1358, and 1405. These functions parse comment text looking for data-settings="..." substrings to support the plugin's media optimization features.
WordPress's wp_kses sanitizer inspects HTML attributes on allowed elements but does not treat data-settings="..." appearing inside text content as an attribute. Attackers exploit this gap by placing the payload inside an allowed element such as <code>. The plugin later interprets the substring as a directive and reflects attacker-controlled content into rendered pages without escaping.
Root Cause
The root cause is a mismatch between WordPress's sanitization model and the plugin's downstream parsing. wp_kses sanitizes based on HTML structure, while LiteSpeed Cache performs a string-level scan for data-settings="..." patterns. A payload built exclusively from decimal numeric character references such as ", <, and > survives kses because it appears as harmless text. Once processed by the plugin's media handler, the references decode into quotes and angle brackets that break out of the intended context.
Attack Vector
An attacker first obtains one approved comment on the target site, a low bar when require_name_email is disabled. The attacker then submits a follow-up comment containing a <code> element whose text is composed of decimal numeric character references encoding a malicious data-settings payload. The plugin processes the comment during page rendering, decodes the references, and emits attacker-controlled HTML into the response. Any visitor, including authenticated administrators, executes the injected script in the site's origin. See the Wordfence Vulnerability Analysis for additional detail.
// No verified proof-of-concept code is published. Refer to the
// vendor changeset for the exact parsing logic that was patched:
// https://plugins.trac.wordpress.org/changeset/3635849/litespeed-cache/trunk/src/media.cls.php
Detection Methods for CVE-2026-18978
Indicators of Compromise
- Comments in wp_comments containing dense sequences of decimal numeric character references such as ", <, and > inside <code> elements.
- Rendered pages that emit data-settings="..." values not present in the original post content.
- Unexpected outbound requests from browsers viewing article pages, indicating script execution.
Detection Strategies
- Query the comments table for approved comments whose comment_content contains <code> tags combined with multiple &# numeric references.
- Compare stored comment content against the HTML actually served to detect divergence introduced by the plugin's media handler.
- Inspect web server access logs for anonymous POST requests to wp-comments-post.php immediately following a first approved comment from the same identity.
Monitoring Recommendations
- Alert on new administrator sessions or role changes shortly after high-traffic page views on posts with recent comments.
- Monitor the LiteSpeed Cache plugin version across managed WordPress sites and flag any instance still running 7.8.1 or earlier.
- Enable Content Security Policy (CSP) violation reporting to surface unexpected inline script execution on comment-heavy pages.
How to Mitigate CVE-2026-18978
Immediate Actions Required
- Upgrade the LiteSpeed Cache plugin to version 7.9 or later on all WordPress sites.
- Rotate administrator credentials and invalidate active sessions if the plugin ran a vulnerable version with public commenting enabled.
- Audit approved comments posted before the upgrade for suspicious <code> blocks and numeric character reference payloads.
Patch Information
The vendor released the fix in WordPress ChangeSet #3635849. Version comparison is available in the 7.8.1 to 7.9 ChangeSet. Site operators should apply the update through the WordPress plugin manager or via wp-cli.
Workarounds
- Enable the require_name_email setting in WordPress Discussion options to break one of the required exploitation preconditions.
- Disable the ability for previously approved commenters to post without moderation by unchecking "Comment author must have a previously approved comment".
- Temporarily disable the LiteSpeed Cache plugin on sites that cannot immediately upgrade.
# Update LiteSpeed Cache to a fixed release using wp-cli
wp plugin update litespeed-cache --version=7.9
# Verify the installed version
wp plugin get litespeed-cache --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
