LiteSpeed Technologies

Records22All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

LiteSpeed Technologies records in CISA KEV

TI-2026-39296 LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability CRITICAL 96KEV 2026-06-15 TI-2026-35606 LiteSpeed cPanel Plugin Privilege Escalation Vulnerability CRITICAL 100KEV 2026-05-26

Components

Products in the NVD configurations · select one to filter the records

Litespeed Web Server 2 records MEDIUM

Records

22 records

TI-2026-35606 CVE-2026-48172 · GHSA-fxrh-cwjh-m33v

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to…

CRITICAL 100KEV

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.17915 Published 2026-05-21 Fixed in 2.4.7, 5.3.1.0 CWE-266

TI-2026-39296 CVE-2026-54420 · GHSA-3g44-c4qc-cxm8

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before…

CRITICAL 96KEV

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as ex…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.01439 Published 2026-06-14 Fixed in 2.4.8 CWE-61

TI-2024-29589 CVE-2024-44000 · GHSA-rh5m-mw2h-v9rv

WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

CRITICAL 90

Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.82335 Published 2024-10-20 No fix listed CWE-522

TI-2024-18601 CVE-2024-28000 · GHSA-3cp9-7899-h8r7

WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

CRITICAL 86

Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.68266 Published 2024-08-21 No fix listed CWE-266

TI-2022-00030 CVE-2022-0073 · GHSA-p42f-x6hp-xv84

Authenticated Remote Code Execution in OpenLiteSpeed Web Server

HIGH 73

Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.09736 Published 2022-10-27 Fixed in 1.7.16.1 CWE-20

TI-2021-22517 CVE-2021-47903 · GHSA-wc7g-3q2h-447c

LiteSpeed Web Server Enterprise 5.4.11 - Command Injection

HIGH 72

LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01626 Published 2026-01-23 No fix listed CWE-78

TI-2023-20892 CVE-2023-40000 · GHSA-fvp6-8p9w-vffq

WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability

HIGH 69

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.54872 Published 2024-04-16 No fix listed CWE-79

TI-2021-22469 CVE-2021-47855 · GHSA-cxv4-2vr2-784m

Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting

MEDIUM 62

Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripts.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00283 Published 2026-01-21 No fix listed CWE-79

TI-2007-05434 CVE-2007-5654 · GHSA-2qqv-pxvf-45vw

LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary…

MEDIUM 51

LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new extension, as demonstrated by reading PHP source code via requests for…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.41064 Published 2007-10-23 No fix listed CWE-200

TI-2024-33979 CVE-2024-50550 · GHSA-g7c2-78mq-v43g

WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability

MEDIUM 45

Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from n/a through <= 6.5.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00899 Published 2024-10-29 No fix listed CWE-266

TI-2026-23945 CVE-2026-31386 · GHSA-3gr9-8p27-7f3p

OS command injection in LiteSpeed Technologies OpenLiteSpeed

MEDIUM 42

OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01471 Published 2026-03-16 No fix listed CWE-78

TI-2023-24061 CVE-2023-45000 · GHSA-8hmx-3p38-h5rw

WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerability

MEDIUM 42

Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache.This issue affects LiteSpeed Cache: from n/a through 5.7.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00413 Published 2024-04-16 No fix listed CWE-862

TI-2024-31916 CVE-2024-47637 · GHSA-xc28-gw78-r3rv

WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability

MEDIUM 41

Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through <= 6.4.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00647 Published 2024-10-16 No fix listed CWE-23

TI-2022-00031 CVE-2022-0074 · GHSA-p85c-c374-mg9g

Privilege Escalation in OpenLiteSpeed Web Server

MEDIUM 41

Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01433 Published 2022-10-27 Fixed in 1.7.16.1 CWE-426

TI-2022-23146 CVE-2022-46800 · GHSA-wqf8-cgg8-vvxm

WordPress LiteSpeed Cache Plugin <= 5.3 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache plugin <= 5.3 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00264 Published 2023-05-25 No fix listed CWE-352

TI-2026-58262 CVE-2026-84761 · GHSA-7xwg-w22f-9qwp

WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability

LOW 37

Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00266 Published 2026-09-03 No fix listed CWE-918

TI-2024-31692 CVE-2024-47374 · GHSA-vj75-x5v7-v952

WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability

LOW 34

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.01396 Published 2024-10-05 No fix listed CWE-79

TI-2025-29934 CVE-2025-47437 · GHSA-wj3g-88qg-cwfg

WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability

LOW 28

Server-Side Request Forgery (SSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 7.0.1.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00257 Published 2025-09-09 No fix listed CWE-918

TI-2024-34819 CVE-2024-51915 · GHSA-prpx-gw6q-vpv2

WordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerability

LOW 28

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00252 Published 2026-02-20 No fix listed CWE-79

TI-2024-31691 CVE-2024-47373 · GHSA-jjr6-f87c-xw24

WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability

LOW 28

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00261 Published 2024-10-05 No fix listed CWE-79

TI-2022-00029 CVE-2022-0072 · GHSA-f532-g5cf-vhjp

Directory Traversal in OpenLiteSpeed Web Server

LOW 28

Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.01143 Published 2022-10-27 Fixed in 1.7.16.1 CWE-22

TI-2005-03490 CVE-2005-3695 · GHSA-m4p8-5q7j-p73v

Cross-site scripting (XSS) vulnerability in admin/config/confMgr.php in LiteSpeed Web…

LOW 24

Cross-site scripting (XSS) vulnerability in admin/config/confMgr.php in LiteSpeed Web Server 2.1.5 allows remote attackers to inject arbitrary web script or HTML via the m parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01929 Published 2005-11-20 No fix listed

Open these records in search →