litespeedtech LiteSpeed Cache vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 20251
3. 20267

Newest CVEs

• CVE-2026-93389

  LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching

  litespeedtech · LiteSpeed Cache

  High8.2
• CVE-2026-116763

  LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)

  litespeedtech · LiteSpeed Cache

  Medium5.4
• CVE-2026-109215

  LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization

  litespeedtech · LiteSpeed Cache

  Medium6.4
• CVE-2026-76579

  LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter

  litespeedtech · LiteSpeed Cache

  Medium4.7
• CVE-2026-3129

  LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes

  litespeedtech · LiteSpeed Cache

  Medium6.4
• CVE-2026-18978

  LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content

  litespeedtech · LiteSpeed Cache

  High7.2
• CVE-2026-3375

  LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints

  litespeedtech · LiteSpeed Cache

  High7.2
• CVE-2025-12450

  LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting

  litespeedtech · LiteSpeed Cache

  Medium6.1
• CVE-2024-9169

  litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

  litespeedtech · LiteSpeed Cache

  Medium5.5
• CVE-2024-3246

  LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

  litespeedtech · LiteSpeed Cache

  Medium6.1