Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

LiteSpeed Cache — Vulnerabilities & Security Advisories 22

All 22 CVE vulnerabilities found in LiteSpeed Cache, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for LiteSpeed Cache, a popular caching plugin for WordPress, focusing on identified security weaknesses and their corresponding risk tags. The collection includes reported defects affecting the plugin across multiple versions, spanning from its early releases through the most recent updates. Here, readers can track vendor advisories, analyze the specific weakness classes involved, and review the product’s historical vulnerability timeline to assess its security posture.

Vendor: Unknown

CVE ID Title CVSS Severity Published
CVE-2026-76579 LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter CWE-79 4.7 Medium 2026-09-19
CVE-2026-84761 WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability CWE-918 7.2 High 2026-09-03
CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes CWE-79 6.4 Medium 2026-08-28
CVE-2026-18978 LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content CWE-79 7.2 High 2026-08-28
CVE-2026-3375 LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints CWE-79 7.2 High 2026-05-27
CVE-2024-51915 WordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2026-02-20
CVE-2025-12450 LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting CWE-79 6.1 Medium 2025-10-29
CVE-2025-47437 WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability CWE-918 6.4 Medium 2025-09-09
CVE-2024-50550 WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability CWE-266 8.1 High 2024-10-29
CVE-2024-44000 WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability CWE-522 9.8 Critical 2024-10-20
CVE-2024-47637 WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability CWE-23 8.8 High 2024-10-16
CVE-2024-47373 WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2024-10-05
CVE-2024-47374 WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2024-10-05
CVE-2024-9169 litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CWE-79 5.5 Medium 2024-09-25
CVE-2024-28000 WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability CWE-266 9.8 Critical 2024-08-21
CVE-2024-3246 LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting CWE-352 6.1 Medium 2024-07-24
CVE-2023-45000 WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerability CWE-862 8.2 High 2024-04-16
CVE-2023-40000 WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability CWE-79 8.3 High 2024-04-16
CVE-2023-4372 LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CWE-79 6.4 Medium 2024-01-11
CVE-2022-46800 WordPress LiteSpeed Cache Plugin <= 5.3 is vulnerable to Cross Site Request Forgery (CSRF) CWE-352 5.4 Medium 2023-05-25
CVE-2021-24964 LiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSS CWE-79 6.1 - 2022-01-03
CVE-2021-24963 LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site Scripting CWE-79 6.1 - 2022-01-03

All 22 known CVE vulnerabilities affecting LiteSpeed Cache with full Chinese analysis, references, and POCs where available.