Litespeed Cache
Litespeedtech · 15 CVEs
LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter
Sep 19, 2026
LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes
Aug 28, 2026
LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Aug 28, 2026
LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints
May 27, 2026
LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting
Oct 29, 2025
WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability
Oct 29, 2024
WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability
Oct 20, 2024
WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability
Oct 16, 2024
WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability
Oct 5, 2024
WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability
Oct 5, 2024
litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Sep 25, 2024
WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability
Aug 21, 2024
LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Jul 24, 2024
WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerability
Apr 16, 2024
WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability
Apr 16, 2024
LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Jan 11, 2024
WordPress LiteSpeed Cache Plugin <= 5.3 is vulnerable to Cross Site Request Forgery (CSRF)
May 25, 2023
LiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSS
Jan 3, 2022
LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site Scripting
Jan 3, 2022
A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited vi…
Dec 26, 2020
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-76579 | LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter | MEDIUM | 0.38% | Sep 19, 2026 |
| CVE-2026-3129 | LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes | MEDIUM | 0.33% | Aug 28, 2026 |
| CVE-2026-18978 | LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content | HIGH | 0.37% | Aug 28, 2026 |
| CVE-2026-3375 | LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints | HIGH | 0.44% | May 27, 2026 |
| CVE-2025-12450 | LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting | MEDIUM | 0.38% | Oct 29, 2025 |
| CVE-2024-50550 | WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability | CRITICAL | 0.90% | Oct 29, 2024 |
| CVE-2024-44000 | WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability | CRITICAL | 82.34% | Oct 20, 2024 |
| CVE-2024-47637 | WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability | HIGH | 0.65% | Oct 16, 2024 |
| CVE-2024-47373 | WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 0.26% | Oct 5, 2024 |
| CVE-2024-47374 | WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability | HIGH | 1.41% | Oct 5, 2024 |
| CVE-2024-9169 | litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting | MEDIUM | 0.28% | Sep 25, 2024 |
| CVE-2024-28000 | WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability | CRITICAL | 68.27% | Aug 21, 2024 |
| CVE-2024-3246 | LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting | MEDIUM | 0.18% | Jul 24, 2024 |
| CVE-2023-45000 | WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerability | HIGH | 0.41% | Apr 16, 2024 |
| CVE-2023-40000 | WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability | HIGH | 54.87% | Apr 16, 2024 |
| CVE-2023-4372 | LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | MEDIUM | 16.77% | Jan 11, 2024 |
| CVE-2022-46800 | WordPress LiteSpeed Cache Plugin <= 5.3 is vulnerable to Cross Site Request Forgery (CSRF) | HIGH | 0.26% | May 25, 2023 |
| CVE-2021-24964 | LiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSS | MEDIUM | 1.22% | Jan 3, 2022 |
| CVE-2021-24963 | LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site Scripting | MEDIUM | 0.65% | Jan 3, 2022 |
| CVE-2020-29172 | A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting. | MEDIUM | 0.94% | Dec 26, 2020 |
Showing 1 to 15 of 15 CVEs