{"schema_version":"2","view":"grouped","data":[{"id":56326,"cve_ids":["CVE-2026-114190"],"payload":{"kind":"advisory","title":"WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability","summary":"Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9.","evidence":"cve:CVE-2026-114190","products":[{"name":{"value":"LiteSpeed Cache","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114190","aliases":["CVE-2026-114190"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hai Zheng / Lite Speed Cache","product":"LiteSpeed Cache","versions":[{"status":"affected","changes":[{"at":"7.9.1","status":"unaffected"}],"version":"0","versionType":"custom","lessThanOrEqual":"7.9"}],"packageName":"litespeed-cache","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:46:58.879Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-7-9-sensitive-data-exposure-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114190","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:41:14.820245Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:46:58.879Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-24T08:00:11.901Z"}}},"related_cves":[{"value":"CVE-2026-114190","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6c2b0a21-95a3-4b67-8d6f-b937428321fe","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114190","advisory_id":"6c2b0a21-95a3-4b67-8d6f-b937428321fe","event_types":["advisory"],"published_at":"2026-10-25T16:12:54.046521+00:00","technologies":["core-cve","litespeed-cache"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T08:00:11.901+00:00","detail_url":"/advisories/advisory%3A6c2b0a21-95a3-4b67-8d6f-b937428321fe","group":{"id":"advisory:6c2b0a21-95a3-4b67-8d6f-b937428321fe","revision":1,"primary_event_id":55849,"change":"published","superseded_by":[],"changed":{"id":55849,"cve_ids":["CVE-2026-114190"],"payload":{"kind":"advisory","title":"WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability","summary":"Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9.","evidence":"cve:CVE-2026-114190","products":[{"name":{"value":"LiteSpeed Cache","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114190","aliases":["CVE-2026-114190"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hai Zheng / Lite Speed Cache","product":"LiteSpeed Cache","versions":[{"status":"affected","changes":[{"at":"7.9.1","status":"unaffected"}],"version":"0","versionType":"custom","lessThanOrEqual":"7.9"}],"packageName":"litespeed-cache","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:46:58.879Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-7-9-sensitive-data-exposure-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114190","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:41:14.820245Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:46:58.879Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-24T08:00:11.901Z"}}},"related_cves":[{"value":"CVE-2026-114190","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6c2b0a21-95a3-4b67-8d6f-b937428321fe","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114190","advisory_id":"6c2b0a21-95a3-4b67-8d6f-b937428321fe","event_types":["advisory"],"published_at":"2026-10-25T16:12:54.046521+00:00","technologies":["core-cve","litespeed-cache"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T08:00:11.901+00:00","detail_url":"/events/55849"},"members":[{"id":55849,"cve_ids":["CVE-2026-114190"],"payload":{"kind":"advisory","title":"WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability","summary":"Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9.","evidence":"cve:CVE-2026-114190","products":[{"name":{"value":"LiteSpeed Cache","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114190","aliases":["CVE-2026-114190"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hai Zheng / Lite Speed Cache","product":"LiteSpeed Cache","versions":[{"status":"affected","changes":[{"at":"7.9.1","status":"unaffected"}],"version":"0","versionType":"custom","lessThanOrEqual":"7.9"}],"packageName":"litespeed-cache","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:46:58.879Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-7-9-sensitive-data-exposure-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114190","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:41:14.820245Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:46:58.879Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-24T08:00:11.901Z"}}},"related_cves":[{"value":"CVE-2026-114190","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6c2b0a21-95a3-4b67-8d6f-b937428321fe","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114190","advisory_id":"6c2b0a21-95a3-4b67-8d6f-b937428321fe","event_types":["advisory"],"published_at":"2026-10-25T16:12:54.046521+00:00","technologies":["core-cve","litespeed-cache"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T08:00:11.901+00:00","detail_url":"/events/55849"}]}},{"id":53119,"cve_ids":["CVE-2026-113501"],"payload":{"kind":"advisory","title":"LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal","summary":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.","evidence":"cve:CVE-2026-113501","products":[{"name":{"value":"LiteSpeed Cache","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113501","aliases":["CVE-2026-113501"],"metrics":[],"affected":[{"vendor":"Unknown","product":"LiteSpeed Cache","versions":[{"status":"affected","version":"0","lessThan":"7.9.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-23T10:46:03.255Z","provider":"cve","references":["https://wpscan.com/vulnerability/a1f6a6c7-1d08-4d5c-ac57-bda5ff59737b/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113501","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T10:36:53.147587Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-862","description":"CWE-862 Missing Authorization"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T10:46:03.255Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-23T06:00:20.493Z"}}},"related_cves":[{"value":"CVE-2026-113501","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:44628104-a367-4850-8644-e6d74ecc76a6","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113501","advisory_id":"44628104-a367-4850-8644-e6d74ecc76a6","event_types":["advisory"],"published_at":"2026-10-25T14:48:52.90727+00:00","technologies":["core-cve","litespeed-cache"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T06:00:20.493+00:00","detail_url":"/advisories/advisory%3A44628104-a367-4850-8644-e6d74ecc76a6","group":{"id":"advisory:44628104-a367-4850-8644-e6d74ecc76a6","revision":1,"primary_event_id":52648,"change":"published","superseded_by":[],"changed":{"id":52648,"cve_ids":["CVE-2026-113501"],"payload":{"kind":"advisory","title":"LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal","summary":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.","evidence":"cve:CVE-2026-113501","products":[{"name":{"value":"LiteSpeed Cache","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113501","aliases":["CVE-2026-113501"],"metrics":[],"affected":[{"vendor":"Unknown","product":"LiteSpeed Cache","versions":[{"status":"affected","version":"0","lessThan":"7.9.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-23T10:46:03.255Z","provider":"cve","references":["https://wpscan.com/vulnerability/a1f6a6c7-1d08-4d5c-ac57-bda5ff59737b/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113501","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T10:36:53.147587Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-862","description":"CWE-862 Missing Authorization"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T10:46:03.255Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-23T06:00:20.493Z"}}},"related_cves":[{"value":"CVE-2026-113501","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:44628104-a367-4850-8644-e6d74ecc76a6","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113501","advisory_id":"44628104-a367-4850-8644-e6d74ecc76a6","event_types":["advisory"],"published_at":"2026-10-25T14:48:52.90727+00:00","technologies":["core-cve","litespeed-cache"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T06:00:20.493+00:00","detail_url":"/events/52648"},"members":[{"id":52648,"cve_ids":["CVE-2026-113501"],"payload":{"kind":"advisory","title":"LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal","summary":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.","evidence":"cve:CVE-2026-113501","products":[{"name":{"value":"LiteSpeed Cache","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113501","aliases":["CVE-2026-113501"],"metrics":[],"affected":[{"vendor":"Unknown","product":"LiteSpeed Cache","versions":[{"status":"affected","version":"0","lessThan":"7.9.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-23T10:46:03.255Z","provider":"cve","references":["https://wpscan.com/vulnerability/a1f6a6c7-1d08-4d5c-ac57-bda5ff59737b/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113501","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T10:36:53.147587Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-862","description":"CWE-862 Missing Authorization"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T10:46:03.255Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-23T06:00:20.493Z"}}},"related_cves":[{"value":"CVE-2026-113501","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:44628104-a367-4850-8644-e6d74ecc76a6","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113501","advisory_id":"44628104-a367-4850-8644-e6d74ecc76a6","event_types":["advisory"],"published_at":"2026-10-25T14:48:52.90727+00:00","technologies":["core-cve","litespeed-cache"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T06:00:20.493+00:00","detail_url":"/events/52648"}]}},{"id":53118,"cve_ids":["CVE-2026-113500"],"payload":{"kind":"advisory","title":"LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization","summary":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.","evidence":"cve:CVE-2026-113500","products":[{"name":{"value":"LiteSpeed Cache","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113500","aliases":["CVE-2026-113500"],"metrics":[],"affected":[{"vendor":"Unknown","product":"LiteSpeed Cache","versions":[{"status":"affected","version":"0","lessThan":"7.9.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-23T10:46:03.416Z","provider":"cve","references":["https://wpscan.com/vulnerability/f841e09f-275c-4c10-a5b7-af294f92db29/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113500","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T10:37:02.256073Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T10:46:03.416Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-23T06:00:20.249Z"}}},"related_cves":[{"value":"CVE-2026-113500","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a7609f50-7a69-4ad8-a96d-0e2d9ec0e086","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113500","advisory_id":"a7609f50-7a69-4ad8-a96d-0e2d9ec0e086","event_types":["advisory"],"published_at":"2026-10-25T14:48:52.295262+00:00","technologies":["core-cve","litespeed-cache"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T06:00:20.249+00:00","detail_url":"/advisories/advisory%3Aa7609f50-7a69-4ad8-a96d-0e2d9ec0e086","group":{"id":"advisory:a7609f50-7a69-4ad8-a96d-0e2d9ec0e086","revision":1,"primary_event_id":52647,"change":"published","superseded_by":[],"changed":{"id":52647,"cve_ids":["CVE-2026-113500"],"payload":{"kind":"advisory","title":"LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization","summary":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.","evidence":"cve:CVE-2026-113500","products":[{"name":{"value":"LiteSpeed Cache","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113500","aliases":["CVE-2026-113500"],"metrics":[],"affected":[{"vendor":"Unknown","product":"LiteSpeed Cache","versions":[{"status":"affected","version":"0","lessThan":"7.9.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-23T10:46:03.416Z","provider":"cve","references":["https://wpscan.com/vulnerability/f841e09f-275c-4c10-a5b7-af294f92db29/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113500","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T10:37:02.256073Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T10:46:03.416Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-23T06:00:20.249Z"}}},"related_cves":[{"value":"CVE-2026-113500","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a7609f50-7a69-4ad8-a96d-0e2d9ec0e086","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113500","advisory_id":"a7609f50-7a69-4ad8-a96d-0e2d9ec0e086","event_types":["advisory"],"published_at":"2026-10-25T14:48:52.295262+00:00","technologies":["core-cve","litespeed-cache"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T06:00:20.249+00:00","detail_url":"/events/52647"},"members":[{"id":52647,"cve_ids":["CVE-2026-113500"],"payload":{"kind":"advisory","title":"LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization","summary":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.","evidence":"cve:CVE-2026-113500","products":[{"name":{"value":"LiteSpeed Cache","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113500","aliases":["CVE-2026-113500"],"metrics":[],"affected":[{"vendor":"Unknown","product":"LiteSpeed Cache","versions":[{"status":"affected","version":"0","lessThan":"7.9.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-23T10:46:03.416Z","provider":"cve","references":["https://wpscan.com/vulnerability/f841e09f-275c-4c10-a5b7-af294f92db29/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113500","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T10:37:02.256073Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T10:46:03.416Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-23T06:00:20.249Z"}}},"related_cves":[{"value":"CVE-2026-113500","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a7609f50-7a69-4ad8-a96d-0e2d9ec0e086","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113500","advisory_id":"a7609f50-7a69-4ad8-a96d-0e2d9ec0e086","event_types":["advisory"],"published_at":"2026-10-25T14:48:52.295262+00:00","technologies":["core-cve","litespeed-cache"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T06:00:20.249+00:00","detail_url":"/events/52647"}]}},{"id":53117,"cve_ids":["CVE-2026-113499"],"payload":{"kind":"advisory","title":"LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting","summary":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.","evidence":"cve:CVE-2026-113499","products":[{"name":{"value":"LiteSpeed Cache","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113499","aliases":["CVE-2026-113499"],"metrics":[],"affected":[{"vendor":"Unknown","product":"LiteSpeed Cache","versions":[{"status":"affected","version":"0","lessThan":"7.9.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-23T10:46:03.570Z","provider":"cve","references":["https://wpscan.com/vulnerability/f04afdab-33fb-41a9-9270-908673998bb8/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113499","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T10:37:20.900382Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T10:46:03.570Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-23T06:00:20.079Z"}}},"related_cves":[{"value":"CVE-2026-113499","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:041dd7cf-f438-4530-b8d7-5204b78a3442","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113499","advisory_id":"041dd7cf-f438-4530-b8d7-5204b78a3442","event_types":["advisory"],"published_at":"2026-10-25T14:48:51.626435+00:00","technologies":["core-cve","litespeed-cache"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T06:00:20.079+00:00","detail_url":"/advisories/advisory%3A041dd7cf-f438-4530-b8d7-5204b78a3442","group":{"id":"advisory:041dd7cf-f438-4530-b8d7-5204b78a3442","revision":1,"primary_event_id":52646,"change":"published","superseded_by":[],"changed":{"id":52646,"cve_ids":["CVE-2026-113499"],"payload":{"kind":"advisory","title":"LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting","summary":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.","evidence":"cve:CVE-2026-113499","products":[{"name":{"value":"LiteSpeed Cache","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113499","aliases":["CVE-2026-113499"],"metrics":[],"affected":[{"vendor":"Unknown","product":"LiteSpeed Cache","versions":[{"status":"affected","version":"0","lessThan":"7.9.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-23T10:46:03.570Z","provider":"cve","references":["https://wpscan.com/vulnerability/f04afdab-33fb-41a9-9270-908673998bb8/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113499","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T10:37:20.900382Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T10:46:03.570Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-23T06:00:20.079Z"}}},"related_cves":[{"value":"CVE-2026-113499","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:041dd7cf-f438-4530-b8d7-5204b78a3442","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113499","advisory_id":"041dd7cf-f438-4530-b8d7-5204b78a3442","event_types":["advisory"],"published_at":"2026-10-25T14:48:51.626435+00:00","technologies":["core-cve","litespeed-cache"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T06:00:20.079+00:00","detail_url":"/events/52646"},"members":[{"id":52646,"cve_ids":["CVE-2026-113499"],"payload":{"kind":"advisory","title":"LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting","summary":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.","evidence":"cve:CVE-2026-113499","products":[{"name":{"value":"LiteSpeed Cache","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113499","aliases":["CVE-2026-113499"],"metrics":[],"affected":[{"vendor":"Unknown","product":"LiteSpeed Cache","versions":[{"status":"affected","version":"0","lessThan":"7.9.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-23T10:46:03.570Z","provider":"cve","references":["https://wpscan.com/vulnerability/f04afdab-33fb-41a9-9270-908673998bb8/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113499","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T10:37:20.900382Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T10:46:03.570Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-23T06:00:20.079Z"}}},"related_cves":[{"value":"CVE-2026-113499","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:041dd7cf-f438-4530-b8d7-5204b78a3442","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113499","advisory_id":"041dd7cf-f438-4530-b8d7-5204b78a3442","event_types":["advisory"],"published_at":"2026-10-25T14:48:51.626435+00:00","technologies":["core-cve","litespeed-cache"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T06:00:20.079+00:00","detail_url":"/events/52646"}]}}],"next_after":56326,"next_before":53117}