LiteSpeed Technologies vulnerabilities

CVEs per yearBy the year they were published

1. 20223
2. 20231
3. 20248
4. 20251
5. 20266

Known exploitedNewest addition to KEV first

• CVE-2026-54420

  LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell…

  LiteSpeed Technologies · cPanel Plugin

  ExploitedHigh8.5
• CVE-2026-48172

  LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via…

  LiteSpeed Technologies · cPanel Plugin

  ExploitedCritical10.0

Newest CVEs

• CVE-2026-84761

  WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability

  LiteSpeed Technologies · LiteSpeed Cache

  High7.2
• CVE-2026-54420

  LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell…

  LiteSpeed Technologies · cPanel Plugin

  ExploitedHigh8.5
• CVE-2026-48172

  LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via…

  LiteSpeed Technologies · cPanel Plugin

  ExploitedCritical10.0
• CVE-2026-31386

  OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by…

  LiteSpeed Technologies · OpenLiteSpeed

  High8.6
• CVE-2024-51915

  WordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerability

  LiteSpeed Technologies · LiteSpeed Cache

  Medium6.5
• CVE-2021-47855

  Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting

  LiteSpeed Technologies · OpenLiteSpeed

  Medium5.1
• CVE-2025-47437

  WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability

  LiteSpeed Technologies · LiteSpeed Cache

  Medium6.4
• CVE-2024-50550

  WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability

  LiteSpeed Technologies · LiteSpeed Cache

  High8.1
• CVE-2024-44000

  WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

  LiteSpeed Technologies · LiteSpeed Cache

  Critical9.8
• CVE-2024-47637

  WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability

  LiteSpeed Technologies · LiteSpeed Cache

  High8.8