What’s Vulnerable › Products
LiteSpeed Technologies LiteSpeed Cache vulnerabilities
26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.
Check whether your LiteSpeed Technologies LiteSpeed Cache version is affected
Latest LiteSpeed Technologies LiteSpeed Cache vulnerabilities
- CVE-2026-113501 — LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal (CVSS 3.1)
- CVE-2026-113500 — LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization (CVSS 7.5)
- CVE-2026-113499 — LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting (CVSS 7.5)
- CVE-2026-76579 — LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter (CVSS 4.7)
- CVE-2026-84761 — WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2)
- CVE-2026-3129 — LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes (CVSS 6.4)
- CVE-2026-18978 — LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2)
- CVE-2026-3375 — LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints (CVSS 7.2)
- CVE-2024-51915 — WordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2025-12450 — LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2025-47437 — WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4)
- CVE-2024-50550 — WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability (CVSS 9.8)
- CVE-2024-44000 — WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability (CVSS 9.8)
- CVE-2024-47637 — WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability (CVSS 8.8)
- CVE-2024-47374 — WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
- CVE-2024-47373 — WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
- CVE-2024-9169 — litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.8)
- CVE-2024-28000 — WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8)
- CVE-2024-3246 — LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2023-45000 — WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerability (CVSS 5.3)
- CVE-2023-40000 — WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability (CVSS 6.1)
- CVE-2023-4372 — LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
- CVE-2022-46800 — WordPress LiteSpeed Cache Plugin <= 5.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
- CVE-2021-24964 — LiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSS (CVSS 6.1)
- CVE-2021-24963 — LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site Scripting (CVSS 4.8)