LiteSpeed Cache CVE-2025-12450

Per the fix commit and changelog, the vulnerable sink is the plugin's footer debug comment (core.cls.php comment()), and the changelog states the issue 'could occur when debug is on' - strongly implying the plugin's debug mode must be ENABLED (a non-default setting) for the payload to be reflected and executed. Additionally, exploitation requires victim user interaction: the attacker must trick a user into clicking a crafted URL (UI:R), and the impact executes in that user's browser context. Limiting factors: non-default debug configuration likely required, mandatory social-engineering/click step, and only low confidentiality/integrity impact (session/DOM-level), not server compromise. The NVD description's generic 'unauthenticated via URLs' framing overstates reach if the debug-mode prerequisite is confirmed.

This is a medium-severity reflected XSS (CVSS 6.1) that signals LOW real-world priority. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates network-reachable, unauthenticated exploitation but requires user interaction (victim must click a crafted link) and yields only low confidentiality/integrity impact with no availability impact. Corroborating signals point the same way: EPSS is 0.38% (29th percentile), there is NO CISA KEV listing (no confirmed active exploitation), and no public exploit code was identified in the provided data - so this is neither widely nor targetedly exploited at time of analysis. A key conflict exists: the NVD/Wordfence description frames this as generic 'Reflected Cross-Site Scripting via URLs,' but the only source-code evidence (the fix commit) escapes a footer debug comment and the changelog explicitly states the flaw 'could occur when debug is on' - implying the vulnerable code path requires the plugin's debug mode to be enabled, a non-default condition the NVD description omits. If that prerequisite holds, real-world exposure is substantially narrower than the raw CVSS network/unauthenticated framing suggests. Verify the exact vulnerable sink with the vendor/Wordfence advisory before treating this as broadly exploitable.

An attacker crafts a URL containing a malicious script payload for a WordPress site running a vulnerable LiteSpeed Cache version and distributes it via phishing or a malicious page. When a victim (likely a logged-in admin, per the debug-footer sink in the fix commit) clicks the link, the unescaped input is reflected into the page and executes in their browser, enabling session/cookie theft or actions in their context. No public exploit was identified at time of analysis, and the fix commit indicates the vulnerable output only renders when debug mode is enabled.