Litespeed Cache
Monthly
Unauthenticated SSRF in the LiteSpeed Cache WordPress plugin (versions ≤ 7.9) allows any remote attacker without credentials to induce the WordPress server to issue arbitrary HTTP requests to internal or external endpoints. Reported by Patchstack under CWE-918, this flaw can expose internal infrastructure, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and backend services not otherwise reachable from the internet. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's massive deployment footprint makes this a meaningful exposure for any internet-facing WordPress installation.
Stored XSS in the LiteSpeed Cache WordPress plugin (all versions through 7.8.1) allows unauthenticated attackers to permanently inject malicious JavaScript into comment-bearing pages by exploiting a bypass in WordPress's wp_kses sanitizer via decimal numeric character references inside permitted HTML elements. The payload persists in the database and executes in every subsequent visitor's browser, creating session-hijacking, credential-theft, and site-defacement opportunities at scale. No active exploitation is confirmed in CISA KEV, but the changeset between tags 7.8.1 and 7.9 on the WordPress plugin repository confirms a vendor-released fix is available.
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote attackers to hijack logged-in sessions, including administrator accounts, by recovering weakly protected session credentials. With a 93.13% EPSS score (100th percentile) and publicly available exploit code, this is among the most likely-to-be-exploited vulnerabilities currently tracked. Successful exploitation yields full WordPress site takeover.
Stored cross-site scripting in the LiteSpeed Cache plugin for WordPress (all versions up to and including 7.9.1) lets an unauthenticated attacker submit a crafted 'comment' value that the plugin's HTML Minify routine fails to sanitize or escape, so the payload is preserved in cached output rather than neutralized. The script executes only when two non-default conditions coincide: the HTML Minify option (O_OPTM_HTML_MIN) is enabled, and a companion plugin renders the stored comment into a raw-text context such as a JSON-LD script block on the same page. Rated CVSS 5.4 with AC:H reflecting that dependency chain; there is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-priority, configuration-dependent issue rather than an actively exploited one.
Stored cross-site scripting in the LiteSpeed Cache plugin for WordPress (all versions up to and including 7.9.1) lets authenticated attackers with subscriber-level access or above plant script-bearing markup through the 'bbp_reply_content' parameter, which later executes in the browser of any user viewing the injected page. The flaw sits in the Viewport Images (VPI) preload routine, which rebuilds image markup from user-supplied content without validating attribute names or escaping attribute values, and it is only reachable when an administrator has enabled VPI with a configured VPI filename that matches an image the attacker can embed, for example a bbPress reply containing raw img tags. Practical risk is materially lower than the raw network vector suggests: exploitation is gated by non-default VPI and bbPress configuration and by PR:L authentication, no public exploit was identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV).
LiteSpeed Cache, the WordPress caching plugin maintained by Hai Zheng, inserts sensitive information into the data it sends back to clients, exposing content that should not be readable by outside parties in releases through 7.9. The CVSS 5.9 score pairs high confidentiality impact with high attack complexity, so while the flaw can be reached unauthenticated over the network with no user interaction, exploitation depends on a specific condition the public sources do not describe. No public exploit was identified at time of analysis, and the single Patchstack reference does not list a fixed version, so any site currently running LiteSpeed Cache 7.9 or earlier remains in scope.
Reflected cross-site scripting in the LiteSpeed Cache plugin for WordPress in all versions up to and including 7.9 allows unauthenticated attackers to inject arbitrary script into a page that runs in a victim's browser when the victim is induced to click a crafted link or submit a crafted request. The payload must be delivered as a POST body field named 'esi' while the query string simultaneously carries a validly signed 'esi' value, exploiting PHP's $_REQUEST merge order so the POST value wins at execution; this two-part delivery plus the signature requirement raises attack complexity, and successful exploitation requires user interaction. Impact is limited to the client side (low confidentiality and integrity, no availability impact), giving a CVSS 3.1 base score of 4.7; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV.
Stored Cross-Site Scripting in LiteSpeed Cache for WordPress (all versions through 7.7) allows authenticated attackers holding Author-level access or higher to inject persistent malicious scripts via specially crafted `<img>` tag attributes. The defect lives in a flawed regular expression inside the plugin's media class that is invoked only when both the 'Lazy Load Images' and 'Add Missing Sizes' features are simultaneously active, causing attribute-embedded payloads to survive sanitization and be stored in page content. Injected scripts execute in the browser of any subsequent visitor, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.5.1. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.4.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.5.0.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 29.5%.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.5.0.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin debug settings in all versions up to, and including, 6.4.1 due to insufficient input sanitization and. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation in LiteSpeed Cache plugin for WordPress (versions up to and including 6.3.0.1) allows unauthenticated remote attackers to forge user identities and gain administrator-level access by exploiting a weak hash check in the plugin's user simulation feature. Publicly available exploit code exists, and the EPSS score of 88.85% (100th percentile) indicates extremely high likelihood of exploitation activity. The vulnerability stems from predictable security hash values that can be brute-forced to impersonate any logged-in user, including administrators.
The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache.7. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in LiteSpeed Cache for WordPress (versions up to and including 5.7) allows remote unauthenticated attackers to inject persistent malicious scripts that execute in the context of any user - including administrators - visiting affected pages. Publicly available exploit code exists and EPSS scores this at 82.03% (99th percentile), indicating very high probability of opportunistic exploitation across the millions of WordPress sites running this plugin. No CISA KEV listing at time of analysis, but the combination of high EPSS, public POC, and massive install base makes this a priority for WordPress operators.
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in versions up to, and including, 5.6 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated SSRF in the LiteSpeed Cache WordPress plugin (versions ≤ 7.9) allows any remote attacker without credentials to induce the WordPress server to issue arbitrary HTTP requests to internal or external endpoints. Reported by Patchstack under CWE-918, this flaw can expose internal infrastructure, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and backend services not otherwise reachable from the internet. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's massive deployment footprint makes this a meaningful exposure for any internet-facing WordPress installation.
Stored XSS in the LiteSpeed Cache WordPress plugin (all versions through 7.8.1) allows unauthenticated attackers to permanently inject malicious JavaScript into comment-bearing pages by exploiting a bypass in WordPress's wp_kses sanitizer via decimal numeric character references inside permitted HTML elements. The payload persists in the database and executes in every subsequent visitor's browser, creating session-hijacking, credential-theft, and site-defacement opportunities at scale. No active exploitation is confirmed in CISA KEV, but the changeset between tags 7.8.1 and 7.9 on the WordPress plugin repository confirms a vendor-released fix is available.
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote attackers to hijack logged-in sessions, including administrator accounts, by recovering weakly protected session credentials. With a 93.13% EPSS score (100th percentile) and publicly available exploit code, this is among the most likely-to-be-exploited vulnerabilities currently tracked. Successful exploitation yields full WordPress site takeover.
Stored cross-site scripting in the LiteSpeed Cache plugin for WordPress (all versions up to and including 7.9.1) lets an unauthenticated attacker submit a crafted 'comment' value that the plugin's HTML Minify routine fails to sanitize or escape, so the payload is preserved in cached output rather than neutralized. The script executes only when two non-default conditions coincide: the HTML Minify option (O_OPTM_HTML_MIN) is enabled, and a companion plugin renders the stored comment into a raw-text context such as a JSON-LD script block on the same page. Rated CVSS 5.4 with AC:H reflecting that dependency chain; there is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-priority, configuration-dependent issue rather than an actively exploited one.
Stored cross-site scripting in the LiteSpeed Cache plugin for WordPress (all versions up to and including 7.9.1) lets authenticated attackers with subscriber-level access or above plant script-bearing markup through the 'bbp_reply_content' parameter, which later executes in the browser of any user viewing the injected page. The flaw sits in the Viewport Images (VPI) preload routine, which rebuilds image markup from user-supplied content without validating attribute names or escaping attribute values, and it is only reachable when an administrator has enabled VPI with a configured VPI filename that matches an image the attacker can embed, for example a bbPress reply containing raw img tags. Practical risk is materially lower than the raw network vector suggests: exploitation is gated by non-default VPI and bbPress configuration and by PR:L authentication, no public exploit was identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV).
LiteSpeed Cache, the WordPress caching plugin maintained by Hai Zheng, inserts sensitive information into the data it sends back to clients, exposing content that should not be readable by outside parties in releases through 7.9. The CVSS 5.9 score pairs high confidentiality impact with high attack complexity, so while the flaw can be reached unauthenticated over the network with no user interaction, exploitation depends on a specific condition the public sources do not describe. No public exploit was identified at time of analysis, and the single Patchstack reference does not list a fixed version, so any site currently running LiteSpeed Cache 7.9 or earlier remains in scope.
Reflected cross-site scripting in the LiteSpeed Cache plugin for WordPress in all versions up to and including 7.9 allows unauthenticated attackers to inject arbitrary script into a page that runs in a victim's browser when the victim is induced to click a crafted link or submit a crafted request. The payload must be delivered as a POST body field named 'esi' while the query string simultaneously carries a validly signed 'esi' value, exploiting PHP's $_REQUEST merge order so the POST value wins at execution; this two-part delivery plus the signature requirement raises attack complexity, and successful exploitation requires user interaction. Impact is limited to the client side (low confidentiality and integrity, no availability impact), giving a CVSS 3.1 base score of 4.7; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV.
Stored Cross-Site Scripting in LiteSpeed Cache for WordPress (all versions through 7.7) allows authenticated attackers holding Author-level access or higher to inject persistent malicious scripts via specially crafted `<img>` tag attributes. The defect lives in a flawed regular expression inside the plugin's media class that is invoked only when both the 'Lazy Load Images' and 'Add Missing Sizes' features are simultaneously active, causing attribute-embedded payloads to survive sanitization and be stored in page content. Injected scripts execute in the browser of any subsequent visitor, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.5.1. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.4.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.5.0.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 29.5%.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.5.0.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin debug settings in all versions up to, and including, 6.4.1 due to insufficient input sanitization and. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation in LiteSpeed Cache plugin for WordPress (versions up to and including 6.3.0.1) allows unauthenticated remote attackers to forge user identities and gain administrator-level access by exploiting a weak hash check in the plugin's user simulation feature. Publicly available exploit code exists, and the EPSS score of 88.85% (100th percentile) indicates extremely high likelihood of exploitation activity. The vulnerability stems from predictable security hash values that can be brute-forced to impersonate any logged-in user, including administrators.
The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache.7. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in LiteSpeed Cache for WordPress (versions up to and including 5.7) allows remote unauthenticated attackers to inject persistent malicious scripts that execute in the context of any user - including administrators - visiting affected pages. Publicly available exploit code exists and EPSS scores this at 82.03% (99th percentile), indicating very high probability of opportunistic exploitation across the millions of WordPress sites running this plugin. No CISA KEV listing at time of analysis, but the combination of high EPSS, public POC, and massive install base makes this a priority for WordPress operators.
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in versions up to, and including, 5.6 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.