LC
Product
LiteSpeed Cache
22
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 3High 4Medium 15Low 0
Watch
Add LiteSpeed Cache to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-109215 New | 6.4 | Oct 29 | LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization Affected: through 7.9.1 |
| CVE-2026-3129 | 6.4 | Aug 28 | LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes Affected: through 7.7 |
| CVE-2025-12450 | 6.1 | Oct 29 | LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting Affected: through 7.5.0.1 |
| CVE-2024-47374 | 6.1 | Oct 5 | WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability Affected: before 6.5.1 |
| CVE-2023-40000 | 6.1 | Apr 16 | WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability Affected: before 5.7.0.1 |
| CVE-2021-24964 | 6.1 | Jan 3 | The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain… Affected: before 4.4.4 |
| CVE-2020-29172 | 6.1 | Dec 26 | A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting Affected: before 3.6.1 |
| CVE-2026-116763 New | 5.4 | Oct 29 | LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace) Affected: through 7.9.1 |
| CVE-2024-47373 | 5.4 | Oct 5 | WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability Affected: before 6.5.1 |
| CVE-2024-3246 | 5.4 | Jul 24 | LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting Affected: through 6.2.0.1 |
| CVE-2023-4372 | 5.4 | Jan 11 | LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 5.6 |
| CVE-2023-45000 | 5.3 | Apr 16 | WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerability Affected: before 5.7.0.1 |
| CVE-2024-9169 | 4.8 | Sep 25 | litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting Affected: through 6.4.1 |
| CVE-2021-24963 | 4.8 | Jan 3 | The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qc_res parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site… Affected: before 4.4.4 |
| CVE-2026-76579 | 4.7 | Sep 19 | LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter Affected: through 7.9 |
Showing 15