LiteSpeed Cache EUVD-2026-32115

Exploitation requires reaching the QUIC.cloud callback REST endpoints /wp-json/litespeed/v1/notify_ccss or /wp-json/litespeed/v1/notify_ucss and defeating their IP-based access control. That access control is bypassable only 'under certain conditions' when the WordPress site is deployed behind a reverse proxy, load balancer, or CDN with configurations that allow the source IP to be spoofed or misattributed (e.g. trusting attacker-controlled forwarding headers) - on a direct-origin deployment with correct IP validation the endpoints are not reachable by an external attacker. The injected JavaScript is stored in CCSS/UCSS content and only executes when that content is later rendered inline on frontend page loads, so impact is also gated on the LiteSpeed Cache CCSS/UCSS optimization features being in use. Limiting factors: although CVSS marks PR:N/UI:N, real-world reach depends on the proxy/CDN misconfiguration above, the affected versions are LiteSpeed Cache ≤7.7, and the stored payload requires a victim to visit an affected page to fire.

Signals point to a real but conditional and currently low-likelihood issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) describes network, low-complexity, unauthenticated exploitation with a changed scope (the injected script executes in the context of site visitors, not the vulnerable component) and low confidentiality/integrity impact, no availability impact - a stored-XSS profile. However, the description materially qualifies the raw vector: the network/unauthenticated reach depends on bypassing IP-based access control, which is only feasible 'under certain conditions' behind a reverse proxy, load balancer, or CDN that mishandles the client source IP. CISA SSVC records Exploitation: none and Technical Impact: partial, while Automatable: yes reflects that the injection step is scriptable once the IP check is defeated. EPSS of 0.07% (20th percentile) and the absence of any KEV listing or public PoC argue against widespread opportunistic exploitation. Net: prioritize patching on sites known to sit behind proxies/CDNs with forwarded-header or trusted-IP misconfiguration; treat as moderate, not emergency, elsewhere. Note the tension to verify: the CVSS marks PR:N (unauthenticated) but real-world exploitability is gated by a deployment-specific access-control bypass, so the unauthenticated network reach is not universal.

An attacker identifies a WordPress site running LiteSpeed Cache ≤7.7 behind a CDN or reverse proxy that lets a forged X-Forwarded-For header satisfy the plugin's IP check, then sends a crafted POST to /wp-json/litespeed/v1/notify_ucss containing CSS that breaks out of the style context and embeds a <script> payload. The plugin stores the payload and renders it inline on subsequent frontend page loads, executing the attacker's JavaScript in the browser of every visitor (and any logged-in administrator) to perform session/cookie theft or admin-context actions. No public proof-of-concept is identified at time of analysis, and the network/low-complexity vector applies only when the IP-based access control can be bypassed.