CVE-2026-76579: LiteSpeed Cache WordPress Plugin XSS Flaw

CVE-2026-76579 Overview

The LiteSpeed Cache plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the esi parameter. All versions up to and including 7.9 are affected. The flaw stems from insufficient input sanitization and output escaping in src/esi.cls.php. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a crafted link. Successful exploitation requires the attacker to supply a validly signed esi value in the GET query string while submitting an attacker-controlled esi payload as a POST body field. The attack relies on PHP's default $_REQUEST merge order, which allows the POST value to take precedence at execution.

Critical Impact

Unauthenticated reflected XSS in a plugin installed on millions of WordPress sites, enabling session theft, admin action forgery, and content injection when a user is tricked into clicking a malicious link.

Affected Products

• LiteSpeed Cache plugin for WordPress, versions up to and including 7.9
• Fixed in LiteSpeed Cache version 7.9.1
• WordPress installations using the vulnerable esi.cls.php component

Discovery Timeline

• 2026-09-19 - CVE-2026-76579 published to NVD
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-76579

Vulnerability Analysis

The vulnerability resides in the Edge Side Includes (ESI) handling logic within src/esi.cls.php. The plugin validates a signed esi value received via the query string but subsequently references the parameter through PHP's $_REQUEST superglobal at the point of execution. Because $_REQUEST merges GET, POST, and COOKIE input with POST typically overriding GET, an attacker can bypass the signature check by placing a valid signed value in the URL and injecting a malicious payload in the POST body. The output is then reflected into the response without adequate escaping, producing browser-side script execution.

Root Cause

The root cause is a combination of inconsistent parameter sourcing and missing output escaping. The signature verification consults one input source, while downstream code consumes the value from $_REQUEST, which resolves to a different, attacker-controlled value. See the vulnerable references in esi.cls.php line 566, line 591, line 617, and line 855.

Attack Vector

An unauthenticated attacker crafts a URL containing a valid signed esi query parameter borrowed from any legitimate ESI request on the target site. The attacker then delivers a form or fetch request that POSTs a malicious esi payload to the same URL. When the victim submits or is redirected to the request, the plugin's signature check passes on the GET value while the reflected output uses the POST payload. The attack requires user interaction and cross-origin delivery, typically through a phishing link or malicious page. Refer to the Wordfence vulnerability report and the official patch changeset for technical details.

Detection Methods for CVE-2026-76579

Indicators of Compromise

• HTTP POST requests to WordPress endpoints containing an esi field with HTML tags, <script>, javascript:, or event-handler attributes such as onerror= and onload=.
• Requests where both the query string and POST body include an esi parameter with mismatched values.
• Web server access logs showing unusual referer headers from external domains preceding requests that hit LiteSpeed Cache ESI endpoints.

Detection Strategies

• Deploy a WAF rule that inspects the esi parameter across GET, POST, and COOKIE sources and flags mismatched or script-bearing values.
• Alert on responses that reflect user-supplied esi content containing HTML control characters that were not HTML-encoded.
• Correlate reflected XSS attempts with subsequent authenticated administrative activity from the same session or IP.

Monitoring Recommendations

• Enable verbose logging on the LiteSpeed Cache plugin and forward web access logs to a centralized analytics platform.
• Monitor WordPress wp-admin audit trails for unexpected plugin, theme, or user account changes following suspicious ESI requests.
• Track outbound requests from browsers of authenticated administrators for beacons to unfamiliar domains that could indicate cookie exfiltration.

How to Mitigate CVE-2026-76579

Immediate Actions Required

• Upgrade the LiteSpeed Cache plugin to version 7.9.1 or later on all WordPress installations.
• Audit administrator sessions and force password resets for any accounts that may have interacted with suspicious links since the plugin was installed.
• Review recently added WordPress users, plugins, and scheduled tasks for signs of post-exploitation persistence.

Patch Information

LiteSpeed released the fix in version 7.9.1. The corrective changes are documented in the changeset diff between 7.9 and 7.9.1. The patch enforces consistent input sourcing for the esi parameter and applies proper output escaping to prevent reflected script execution.

Workarounds

• If immediate patching is not feasible, disable the LiteSpeed Cache plugin until the update can be applied.
• Deploy a Web Application Firewall (WAF) rule that rejects requests containing an esi POST field with HTML or JavaScript metacharacters.
• Enforce a strict Content Security Policy (CSP) on WordPress responses to limit the impact of reflected script injection.

# Example WAF rule concept (ModSecurity syntax)
SecRule ARGS_POST:esi "@rx (?i)(<script|javascript:|on\w+\s*=)" \
  "id:1076579,phase:2,deny,status:403,msg:'CVE-2026-76579 LiteSpeed Cache esi XSS attempt'"