LC
Product
LiteSpeed Cache
22
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 3High 4Medium 15Low 0
Watch
Add LiteSpeed Cache to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-50550 | 9.8 | Oct 29 | WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability Affected: before 6.5.2 |
| CVE-2024-44000 | 9.8 | Oct 20 | WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability Affected: before 6.5.0.1 |
| CVE-2024-28000 | 9.8 | Aug 21 | WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability Affected: 1.9 before 6.4 |
| CVE-2024-47637 | 8.8 | Oct 16 | WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability Affected: before 6.5.1 |
| CVE-2022-46800 | 8.8 | May 25 | WordPress LiteSpeed Cache Plugin <= 5.3 is vulnerable to Cross Site Request Forgery (CSRF) Affected: through 5.3 |
| CVE-2026-18978 | 7.2 | Aug 28 | LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content Affected: through 7.8.1 |
| CVE-2026-3375 | 7.2 | May 27 | LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints Affected: through 7.7 |
| CVE-2026-109215 New | 6.4 | Oct 29 | LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization Affected: through 7.9.1 |
| CVE-2026-3129 | 6.4 | Aug 28 | LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes Affected: through 7.7 |
| CVE-2025-12450 | 6.1 | Oct 29 | LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting Affected: through 7.5.0.1 |
| CVE-2024-47374 | 6.1 | Oct 5 | WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability Affected: before 6.5.1 |
| CVE-2023-40000 | 6.1 | Apr 16 | WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability Affected: before 5.7.0.1 |
| CVE-2021-24964 | 6.1 | Jan 3 | The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain… Affected: before 4.4.4 |
| CVE-2020-29172 | 6.1 | Dec 26 | A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting Affected: before 3.6.1 |
| CVE-2026-116763 New | 5.4 | Oct 29 | LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace) Affected: through 7.9.1 |
| CVE-2024-47373 | 5.4 | Oct 5 | WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability Affected: before 6.5.1 |
| CVE-2024-3246 | 5.4 | Jul 24 | LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting Affected: through 6.2.0.1 |
| CVE-2023-4372 | 5.4 | Jan 11 | LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 5.6 |
| CVE-2023-45000 | 5.3 | Apr 16 | WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerability Affected: before 5.7.0.1 |
| CVE-2024-9169 | 4.8 | Sep 25 | litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting Affected: through 6.4.1 |
| CVE-2021-24963 | 4.8 | Jan 3 | The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qc_res parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site… Affected: before 4.4.4 |
| CVE-2026-76579 | 4.7 | Sep 19 | LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter Affected: through 7.9 |
Showing 22