LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the /wp-json/litespeed/v1/notify_ccss and /wp-json/litespeed/v1/notify_ucss REST API endpoints in all versions up to, and including, 7.7. These endpoints accept CSS content from QUIC.cloud callback notifications and store it to disk without sanitization. The stored content is later rendered inline frontend page loads without output escaping. The access control protecting these endpoints is IP-based validation that can potentially be bypassed when the WordPress site is deployed behind a reverse proxy, load balancer, or CDN with certain configurations. This makes it possible for unauthenticated attackers, under certain conditions, to inject arbitrary JavaScript into CCSS/UCSS content.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| litespeedtech | LiteSpeed Cache | up to 7.7 | — | No fix listed | CNA |
- LiteSpeed Cache Vendorlitespeedtech Affected up to 7.7 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:*:*:* | — | — | litespeedtech |
- cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:*:*:* Versions — — ·litespeedtech
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3375
- 2026-10-03 Alias added: GHSA-hf4x-3pgg-4r9c
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/40fa29f5-525a-4986-91f9-0210a7594e46?source=cve
- https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/rest.cls.php#L108
- https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/cloud.cls.php#L2085
- https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/css.cls.php#L401
- https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/css.cls.php#L595
- https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/optimize.cls.php#L477
- https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/router.cls.php#L732
- https://plugins.trac.wordpress.org/changeset/3473912/
More litespeedtech vulnerabilities
- TI-2026-35606 LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to… KEVCVSS 4.0CRITICAL 10.0
- TI-2026-39296 LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before… KEVCVSS 3.1HIGH 8.5
- TI-2024-29589 WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-18601 WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
- TI-2022-00030 Authenticated Remote Code Execution in OpenLiteSpeed Web Server CVSS 3.1HIGH 8.8
- TI-2026-83023 Client certificate bypass over HTTP/3 in OpenLiteSpeed CVSS 4.0HIGH 8.2
Sources
- CVE-2026-3375 · CVE Program
- CVE-2026-3375 · NVD
- FIRST EPSS
- GHSA-hf4x-3pgg-4r9c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences