CVE-2026-76579

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the attacker supply a validly signed 'esi' value in the GET query string while submitting a separate attacker-controlled 'esi' payload as a POST body field, relying on PHP's default $_REQUEST merge order to have the POST value take precedence at the point of execution.

• CWE-79

• https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9/src/esi.cls.php#L566
• https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9/src/esi.cls.php#L591
• https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9/src/esi.cls.php#L617
• https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9/src/esi.cls.php#L855
• https://plugins.trac.wordpress.org/changeset/3676856/litespeed-cache/trunk/src/esi.cls.php
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3676856%40litespeed-cache%2Ftags%2F7.9.1&old=3635849%40litespeed-cache%2Ftags%2F7.9
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ba236f86-0434-4030-8e14-4db3919226eb?source=cve

Published

Sep 19, 2026

Last Modified

Sep 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76571Joomla Extension - fabrikar.com - Unauthenticated SQL inject…9.3
• CVE-2026-76572A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3…4.7
• CVE-2026-76573The Pods – Custom Content Types and Fields plugin for WordPr…6.4
• CVE-2026-76574A flaw has been found in code-projects Hospital Information …7.3
• CVE-2026-76576A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3…4.3
• CVE-2026-76578A flaw was found in FreeIPA. The self-managed OTP token ACI …9.8
• CVE-2026-7658IBM Langflow OSS 1.0.0 through 1.10.3 does not properly vali…6.5
• CVE-2026-76581The WPMU DEV Dashboard plugin for WordPress is vulnerable to…9.8
• CVE-2026-76582A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01…7.4
• CVE-2026-76583A vulnerability was identified in TRENDnet TV-IP751WIC 11.03…7.4
• CVE-2026-76584A security flaw has been discovered in TRENDnet TV-IP751WIC …9.9
• CVE-2026-76585The Customer Reviews for WooCommerce WordPress plugin before…8.8