Litespeedtech vulnerabilities

Products

• Litespeed Cache 29
• Litespeed Cache 15
• Openlitespeed 14
• Litespeed Web Server 5
• Lsquic 5
• Litespeed Cpanel Plugin 2
• Litespeed Whm Plugin 2

Newest

• litespeedtech litespeed cache LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching CVE-2026-93389 8.2 HighNovember 5, 2026
• litespeed technologies openlitespeed OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch CVE-2026-119559 8.2 HighOctober 30, 2026
• litespeedtech litespeed cache LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace) CVE-2026-116763 5.4 MediumOctober 29, 2026
• litespeedtech litespeed cache LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization CVE-2026-109215 6.4 MediumOctober 29, 2026
• hai zheng / lite speed cache litespeed cache WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability CVE-2026-114190 5.9 MediumOctober 24, 2026
• litespeedtech litespeed cache LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal CVE-2026-113501 3.1 LowOctober 23, 2026
• litespeedtech litespeed cache LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization CVE-2026-113500 7.5 HighOctober 23, 2026
• litespeedtech litespeed cache LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting CVE-2026-113499 7.5 HighOctober 23, 2026
• litespeedtech lsquic In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because... CVE-2026-115482 7.5 HighOctober 22, 2026
• litespeed technologies openlitespeed OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update CVE-2026-104474 5.4 MediumOctober 2, 2026
• litespeed technologies web server, litespeedtech litespeed web server +1 more LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a... CVE-2026-93903 Public exploit 9.4 CriticalSeptember 30, 2026
• litespeedtech litespeed cache LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter CVE-2026-76579 4.7 MediumSeptember 19, 2026
• litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-84761 7.2 HighSeptember 3, 2026
• litespeedtech litespeed cache LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes CVE-2026-3129 6.4 MediumAugust 28, 2026
• litespeedtech litespeed cache LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVE-2026-18978 7.2 HighAugust 28, 2026
• litespeed cpanel plugin, litespeedtech litespeed cpanel plugin, litespeed whm plugin +2 more LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0)... CVE-2026-54420 In KEVPublic exploit 8.5 HighJune 14, 2026
• litespeedtech litespeed cache LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints CVE-2026-3375 7.2 HighMay 27, 2026
• litespeed cpanel plugin, litespeed technologies whm plugin, litespeedtech litespeed cpanel plugin +1 more +3 more LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as... CVE-2026-48172 In KEVPublic exploit EPSS 17.9% 10.0 CriticalMay 21, 2026
• litespeed technologies lsws enterprise, openlitespeed, litespeedtech litespeed web server +2 more OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command... CVE-2026-31386 8.6 HighMarch 16, 2026
• litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerability CVE-2024-51915 6.5 MediumFebruary 20, 2026
• litespeedtech litespeed cache LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting CVE-2025-12450 6.1 MediumOctober 29, 2025
• litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability CVE-2025-47437 6.4 MediumSeptember 9, 2025
• litespeedtech lsquic, litespeed web adc, litespeed web server +1 more +3 more LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. CVE-2025-54939 Public exploit 5.3 MediumAugust 1, 2025
• litespeedtech lsquic A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka... CVE-2025-24947 5.3 MediumFebruary 20, 2025
• litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability CVE-2024-50550 8.1 HighOctober 29, 2024
• litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability CVE-2024-44000 Public exploit EPSS 82.3% 9.8 CriticalOctober 20, 2024
• litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability CVE-2024-47637 8.8 HighOctober 16, 2024
• litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability CVE-2024-47373 6.5 MediumOctober 5, 2024
• litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability CVE-2024-47374 7.1 HighOctober 5, 2024
• litespeedtech litespeed cache litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-9169 5.5 MediumSeptember 25, 2024
• litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability CVE-2024-28000 Public exploit EPSS 68.3% 9.8 CriticalAugust 21, 2024
• litespeedtech litespeed cache LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-3246 6.1 MediumJuly 24, 2024
• litespeedtech openlitespeed OpenLiteSpeed before 1.8.1 mishandles chunked encoding. CVE-2024-31617 5.3 MediumMay 22, 2024
• litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerability CVE-2023-45000 8.2 HighApril 16, 2024
• litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability CVE-2023-40000 Public exploit EPSS 54.9% 8.3 HighApril 16, 2024
• litespeedtech lsquic In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled. CVE-2024-25678 9.8 CriticalFebruary 9, 2024
• litespeedtech litespeed cache LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-4372 EPSS 19.5% 6.4 MediumJanuary 11, 2024
• litespeedtech openlitespeed LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers. CVE-2023-40518 7.5 HighAugust 14, 2023
• litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache Plugin <= 5.3 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2022-46800 5.4 MediumMay 25, 2023
• litespeed technologies web server, openlitespeed web server, litespeedtech openlitespeed +2 more Privilege Escalation in OpenLiteSpeed Web Server CVE-2022-0074 8.8 HighOctober 27, 2022
• litespeed technologies web server, openlitespeed web server, litespeedtech openlitespeed +2 more Authenticated Remote Code Execution in OpenLiteSpeed Web Server CVE-2022-0073 8.8 HighOctober 27, 2022
• litespeed technologies web server, openlitespeed web server, litespeedtech openlitespeed +2 more Directory Traversal in OpenLiteSpeed Web Server CVE-2022-0072 5.8 MediumOctober 27, 2022
• litespeedtech lsquic liblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles... CVE-2022-30592 Public exploit 9.8 CriticalMay 11, 2022
• litespeedtech litespeed cache LiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSS CVE-2021-24964 6.1 MediumJanuary 3, 2022
• litespeedtech litespeed cache LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site Scripting CVE-2021-24963 4.8 MediumJanuary 3, 2022
• litespeedtech openlitespeed Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows... CVE-2021-26758 8.8 HighApril 7, 2021
• litespeedtech litespeed cache A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for... CVE-2020-29172 6.1 MediumDecember 26, 2020
• litespeedtech openlitespeed The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as... CVE-2020-5519 9.8 CriticalJanuary 6, 2020
• litespeedtech openlitespeed The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of... CVE-2018-19792 6.7 MediumDecember 3, 2018
• litespeedtech openlitespeed The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for... CVE-2018-19791 6.5 MediumDecember 3, 2018
• Show olderLoading…