Where
-Infinity
0

Trending

Last week
Last month
Last year

Litespeed Technologies LiteSpeed CacheWordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability

Risk 89
Severity
9.8
Weak Encryption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from n/a through <= 6.5.1.

Remedy

Update to 6.5.2 or a higher version.
First published (updated )
CVE-2024-50550

Litespeedtech Litespeed Cache WordpressWordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

Risk 99
Severity
9.8
Exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.

Remedy

Update to 6.4 or a higher version.
First published (updated )
CVE-2024-28000

Litespeed Technologies LiteSpeed CacheWordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerability

Risk 54
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache.This issue affects LiteSpeed Cache: from n/a through 5.7.

Remedy

Update to 5.7.0.1 or a higher version.
First published (updated )
CVE-2023-45000

Litespeed Technologies LiteSpeed CacheWordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability

Risk 62
Severity
8.3
XSS
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.

Remedy

Update to 5.7.0.1 or a higher version.
First published (updated )
CVE-2023-40000

Litespeed Technologies LiteSpeed CacheWordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability

Risk 39
Severity
6.4
SSRF
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Server-Side Request Forgery (SSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 7.0.1.

1 / 2
Source: MITRE

Remedy

Update the WordPress LiteSpeed Cache plugin to the latest available version (at least 7.1).
First published (updated )
CVE-2025-47437

Litespeed Technologies LiteSpeed CacheWordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerability

Risk 46
Severity
6.5
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.2.

First published (updated )
CVE-2024-51915

Litespeed Technologies LiteSpeed CacheWordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability

Risk 38
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.0.2.

Remedy

Update to 6.5.1 or a higher version.
First published (updated )
CVE-2024-47374

Litespeedtech Litespeed Cache WordpressWordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability

Risk 79
Severity
8.8
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through <= 6.4.1.

Remedy

Update to 6.5.1 or a higher version.
First published (updated )
CVE-2024-47637

Litespeed Technologies LiteSpeed CacheWordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability

Risk 34
Severity
6.5
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.0.2.

Remedy

Update to 6.5.1 or a higher version.
First published (updated )
CVE-2024-47373

Litespeedtech Litespeed Cache WordpressLiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSS

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.

First published (updated )
CVE-2021-24964

Litespeedtech Litespeed Cache WordpressXSS

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting.

First published (updated )
CVE-2020-29172

Litespeedtech Litespeed Cache WordpressLiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site Scripting

Risk 29
Severity
4.8
XSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qcres parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting

First published (updated )
CVE-2021-24963

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203