Litespeed Cache
Monthly
Unauthenticated SSRF in the LiteSpeed Cache WordPress plugin (versions ≤ 7.9) allows any remote attacker without credentials to induce the WordPress server to issue arbitrary HTTP requests to internal or external endpoints. Reported by Patchstack under CWE-918, this flaw can expose internal infrastructure, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and backend services not otherwise reachable from the internet. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's massive deployment footprint makes this a meaningful exposure for any internet-facing WordPress installation.
Stored XSS in the LiteSpeed Cache WordPress plugin (all versions through 7.8.1) allows unauthenticated attackers to permanently inject malicious JavaScript into comment-bearing pages by exploiting a bypass in WordPress's wp_kses sanitizer via decimal numeric character references inside permitted HTML elements. The payload persists in the database and executes in every subsequent visitor's browser, creating session-hijacking, credential-theft, and site-defacement opportunities at scale. No active exploitation is confirmed in CISA KEV, but the changeset between tags 7.8.1 and 7.9 on the WordPress plugin repository confirms a vendor-released fix is available.
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote attackers to hijack logged-in sessions, including administrator accounts, by recovering weakly protected session credentials. With a 93.13% EPSS score (100th percentile) and publicly available exploit code, this is among the most likely-to-be-exploited vulnerabilities currently tracked. Successful exploitation yields full WordPress site takeover.
Stored Cross-Site Scripting in LiteSpeed Cache for WordPress (all versions through 7.7) allows authenticated attackers holding Author-level access or higher to inject persistent malicious scripts via specially crafted `<img>` tag attributes. The defect lives in a flawed regular expression inside the plugin's media class that is invoked only when both the 'Lazy Load Images' and 'Add Missing Sizes' features are simultaneously active, causing attribute-embedded payloads to survive sanitization and be stored in page content. Injected scripts execute in the browser of any subsequent visitor, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.5.1. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.4.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.5.0.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 29.5%.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.5.0.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin debug settings in all versions up to, and including, 6.4.1 due to insufficient input sanitization and. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation in LiteSpeed Cache plugin for WordPress (versions up to and including 6.3.0.1) allows unauthenticated remote attackers to forge user identities and gain administrator-level access by exploiting a weak hash check in the plugin's user simulation feature. Publicly available exploit code exists, and the EPSS score of 88.85% (100th percentile) indicates extremely high likelihood of exploitation activity. The vulnerability stems from predictable security hash values that can be brute-forced to impersonate any logged-in user, including administrators.
The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache.7. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in LiteSpeed Cache for WordPress (versions up to and including 5.7) allows remote unauthenticated attackers to inject persistent malicious scripts that execute in the context of any user - including administrators - visiting affected pages. Publicly available exploit code exists and EPSS scores this at 82.03% (99th percentile), indicating very high probability of opportunistic exploitation across the millions of WordPress sites running this plugin. No CISA KEV listing at time of analysis, but the combination of high EPSS, public POC, and massive install base makes this a priority for WordPress operators.
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in versions up to, and including, 5.6 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated SSRF in the LiteSpeed Cache WordPress plugin (versions ≤ 7.9) allows any remote attacker without credentials to induce the WordPress server to issue arbitrary HTTP requests to internal or external endpoints. Reported by Patchstack under CWE-918, this flaw can expose internal infrastructure, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and backend services not otherwise reachable from the internet. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's massive deployment footprint makes this a meaningful exposure for any internet-facing WordPress installation.
Stored XSS in the LiteSpeed Cache WordPress plugin (all versions through 7.8.1) allows unauthenticated attackers to permanently inject malicious JavaScript into comment-bearing pages by exploiting a bypass in WordPress's wp_kses sanitizer via decimal numeric character references inside permitted HTML elements. The payload persists in the database and executes in every subsequent visitor's browser, creating session-hijacking, credential-theft, and site-defacement opportunities at scale. No active exploitation is confirmed in CISA KEV, but the changeset between tags 7.8.1 and 7.9 on the WordPress plugin repository confirms a vendor-released fix is available.
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote attackers to hijack logged-in sessions, including administrator accounts, by recovering weakly protected session credentials. With a 93.13% EPSS score (100th percentile) and publicly available exploit code, this is among the most likely-to-be-exploited vulnerabilities currently tracked. Successful exploitation yields full WordPress site takeover.
Stored Cross-Site Scripting in LiteSpeed Cache for WordPress (all versions through 7.7) allows authenticated attackers holding Author-level access or higher to inject persistent malicious scripts via specially crafted `<img>` tag attributes. The defect lives in a flawed regular expression inside the plugin's media class that is invoked only when both the 'Lazy Load Images' and 'Add Missing Sizes' features are simultaneously active, causing attribute-embedded payloads to survive sanitization and be stored in page content. Injected scripts execute in the browser of any subsequent visitor, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.5.1. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.4.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.5.0.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 29.5%.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.5.0.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin debug settings in all versions up to, and including, 6.4.1 due to insufficient input sanitization and. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation in LiteSpeed Cache plugin for WordPress (versions up to and including 6.3.0.1) allows unauthenticated remote attackers to forge user identities and gain administrator-level access by exploiting a weak hash check in the plugin's user simulation feature. Publicly available exploit code exists, and the EPSS score of 88.85% (100th percentile) indicates extremely high likelihood of exploitation activity. The vulnerability stems from predictable security hash values that can be brute-forced to impersonate any logged-in user, including administrators.
The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache.7. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in LiteSpeed Cache for WordPress (versions up to and including 5.7) allows remote unauthenticated attackers to inject persistent malicious scripts that execute in the context of any user - including administrators - visiting affected pages. Publicly available exploit code exists and EPSS scores this at 82.03% (99th percentile), indicating very high probability of opportunistic exploitation across the millions of WordPress sites running this plugin. No CISA KEV listing at time of analysis, but the combination of high EPSS, public POC, and massive install base makes this a priority for WordPress operators.
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in versions up to, and including, 5.6 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.