LiteSpeed Cache
CVE-2023-40000
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify WordPress site running LiteSpeed Cache ≤5.7
-
DeliverySubmit crafted XSS payload to vulnerable input
-
ExploitPayload stored in plugin data
-
InstallAdministrator loads affected page
-
C2Injected script executes in admin session
-
ExecuteSteal session or create rogue admin
-
ImpactFull site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target site must be running WordPress with the LiteSpeed Cache plugin installed and active at any version from initial release through 5.7 (CPE cpe:2.3:a:litespeedtech:litespeed_cache up to 5.7). CVSS PR:N indicates the injection step requires no authentication, and UI:N indicates no user interaction is needed for the injection itself; however, as a stored XSS, monetizing the payload (session theft, admin takeover) requires a privileged user - typically a logged-in administrator - to subsequently load a page that renders the stored payload, which limits impact on sites with infrequent admin logins or strong session isolation. No non-default configuration is documented as required - the vulnerable code path is present in standard plugin installations within the affected version range. |
| Impact | Signals converge on elevated real-world risk: CVSS 8.3 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity, unauthenticated exploitation with changed scope (the injected script reaches users beyond the vulnerable component's security authority), and EPSS at 82.03% (99th percentile) reflects very high predicted exploitation probability. Publicly available exploit code further lowers the skill barrier. Counterbalancing factors: the vector reports UI:N yet stored XSS in practice depends on a victim loading an affected page (the CVSS UI:N reflects that the injection step requires no interaction, not that triggering is interaction-free) - defenders should not interpret UI:N as 'fires without any user action.' The vulnerability is not currently on the CISA KEV list, so confirmed in-the-wild abuse against U.S. federal systems is not documented, but the combination of public POC, high EPSS, and the plugin's enormous WordPress install base makes mass opportunistic exploitation realistic. |
| Exploit ScenarioDerived | A remote unauthenticated attacker submits a crafted payload to a LiteSpeed Cache input field or endpoint that fails to sanitize user input; the payload is persisted server-side and embedded into subsequent page renders. When a WordPress administrator later loads the affected page in their authenticated session, the injected JavaScript executes in their browser context, allowing session hijack, creation of attacker-controlled admin accounts, or backdoor plugin installation - a public exploit lowers the barrier so commodity scanners can chain this into full site takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Stored cross-site scripting in LiteSpeed Cache for WordPress (versions up to and including 5.7) allows remote unauthenticated attackers to inject persistent malicious scripts that execute in the context of any user - including administrators - visiting affected pages. Publicly available exploit code exists and EPSS scores this at 82.03% (99th percentile), indicating very high probability of opportunistic exploitation across the millions of WordPress sites running this plugin. No CISA KEV listing at time of analysis, but the combination of high EPSS, public POC, and massive install base makes this a priority for WordPress operators.
RemediationAI
Upgrade the LiteSpeed Cache plugin to a version later than 5.7 via the WordPress plugin updater or by downloading from wordpress.org/plugins/litespeed-cache; the affected-range upper bound in NVD data is 5.7, and Patchstack's advisory for this CVE identifies the fixed release as the next maintenance version, so any version newer than 5.7 (5.7.0.1 / 5.8 and later) should contain the sanitization fix - verify the exact patched version against the vendor changelog before deploying. If immediate patching is not possible, compensating controls include temporarily deactivating LiteSpeed Cache (accepting the performance hit and loss of caching/optimization features), restricting access to plugin-managed input fields and admin endpoints behind IP allowlists or WAF rules that block typical XSS payloads (with the trade-off of false positives on legitimate rich content), and deploying a strict Content-Security-Policy that disallows inline script (which can break themes or other plugins that rely on inline JS). Audit existing cached content and stored plugin data for previously injected payloads, since stored XSS persists across the patch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LiteSpeed Cache is a popular WordPress caching and site-acceleration plugin (CPE cpe:2.3:a:litespeedtech:litespeed_cache) developed by LiteSpeed Technologies, with an install footprint in the millions of WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant: user-controllable input is persisted by the plugin and later rendered into HTML responses without sufficient output encoding or input sanitization, so injected script payloads execute in any visitor's browser session. Because the payload is stored server-side, every subsequent page render delivers the attack - no per-victim social engineering is required after initial injection.
Know when Litespeed Cache gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.
Executive ViewAI
WordPress websites running LiteSpeed Cache plugin (versions ≤5.7) are vulnerable to account compromise via persistent script injection attacks, with publicly available exploit code and no vendor patch available. This vulnerability could enable attackers to hijack administrator accounts, exfiltrate sensitive data, and disrupt web operations across potentially millions of affected websites.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately deactivate or uninstall the plugin on all affected WordPress instances; (2) Deploy Web Application Firewall rules targeting stored XSS signatures in LiteSpeed Cache parameters; (3) Implement strict Content Security Policy headers to prevent malicious script execution; (4) Restrict administrative access to affected websites where immediate deactivation is not possible; (5) Enable comprehensive logging and monitoring for exploitation attempts and account access anomalies; (6) Establish incident response procedures for rapid containment if account compromise is detected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
More in Litespeed Cache
View allAuthentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
Privilege escalation in LiteSpeed Cache plugin for WordPress (versions up to and including 6.3.0.1) allows unauthenticat
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technolo
Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.4.
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege
Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache.7. Rated high severity (CVSS 8.2), this vu
Stored XSS in the LiteSpeed Cache WordPress plugin (all versions through 7.8.1) allows unauthenticated attackers to perm
Unauthenticated SSRF in the LiteSpeed Cache WordPress plugin (versions ≤ 7.9) allows any remote attacker without credent
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in version
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technolo
Stored cross-site scripting in the LiteSpeed Cache plugin for WordPress (all versions up to and including 7.9.1) lets au
Stored Cross-Site Scripting in LiteSpeed Cache for WordPress (all versions through 7.7) allows authenticated attackers h
Exploit-DB