Skip to content

Litespeedtech Litespeed Cache vulnerabilities

litespeedtech litespeed cache LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching CVE-2026-93389 8.2 HighNovember 5, 2026
litespeedtech litespeed cache LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace) CVE-2026-116763 5.4 MediumOctober 29, 2026
litespeedtech litespeed cache LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization CVE-2026-109215 6.4 MediumOctober 29, 2026
hai zheng / lite speed cache litespeed cache WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability CVE-2026-114190 5.9 MediumOctober 24, 2026
litespeedtech litespeed cache LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal CVE-2026-113501 3.1 LowOctober 23, 2026
litespeedtech litespeed cache LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization CVE-2026-113500 7.5 HighOctober 23, 2026
litespeedtech litespeed cache LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting CVE-2026-113499 7.5 HighOctober 23, 2026
litespeedtech litespeed cache LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter CVE-2026-76579 4.7 MediumSeptember 19, 2026
litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-84761 7.2 HighSeptember 3, 2026
litespeedtech litespeed cache LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes CVE-2026-3129 6.4 MediumAugust 28, 2026
litespeedtech litespeed cache LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVE-2026-18978 7.2 HighAugust 28, 2026
litespeedtech litespeed cache LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints CVE-2026-3375 7.2 HighMay 27, 2026
litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerability CVE-2024-51915 6.5 MediumFebruary 20, 2026
litespeedtech litespeed cache LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting CVE-2025-12450 6.1 MediumOctober 29, 2025
litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability CVE-2025-47437 6.4 MediumSeptember 9, 2025
litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability CVE-2024-50550 8.1 HighOctober 29, 2024
litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability CVE-2024-44000 Public exploit EPSS 82.3% 9.8 CriticalOctober 20, 2024
litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability CVE-2024-47637 8.8 HighOctober 16, 2024
litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability CVE-2024-47373 6.5 MediumOctober 5, 2024
litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability CVE-2024-47374 7.1 HighOctober 5, 2024
litespeedtech litespeed cache litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-9169 5.5 MediumSeptember 25, 2024
litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability CVE-2024-28000 Public exploit EPSS 68.3% 9.8 CriticalAugust 21, 2024
litespeedtech litespeed cache LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-3246 6.1 MediumJuly 24, 2024
litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerability CVE-2023-45000 8.2 HighApril 16, 2024
litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability CVE-2023-40000 Public exploit EPSS 54.9% 8.3 HighApril 16, 2024
litespeedtech litespeed cache LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-4372 EPSS 19.5% 6.4 MediumJanuary 11, 2024
litespeed technologies cache, litespeedtech litespeed cache +1 more WordPress LiteSpeed Cache Plugin <= 5.3 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2022-46800 5.4 MediumMay 25, 2023
litespeedtech litespeed cache LiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSS CVE-2021-24964 6.1 MediumJanuary 3, 2022
litespeedtech litespeed cache LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site Scripting CVE-2021-24963 4.8 MediumJanuary 3, 2022