Llitespeedtech

Products

Exploited and recent CVEs

• CVE-2026-93389 High 8.2 LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching 0.2%
• CVE-2026-119559 Medium 5.9 OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch 0.3%
• CVE-2026-116763 Medium 5.4 LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace) 0.3%
• CVE-2026-109215 Medium 6.4 LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization 0.3%
• CVE-2026-115482 High 7.5 In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This 0.4%
• CVE-2026-104474 Medium 6.7 OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update <0.1%
• CVE-2026-93903 Critical 9.4 LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged tenant execute code in t 0.4%
• CVE-2026-76579 Medium 4.7 LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter 0.4%
• CVE-2026-3129 Medium 6.4 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes 0.3%
• CVE-2026-18978 High 7.2 LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content 0.4%
• CVE-2026-3375 High 7.2 LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints 0.4%
• CVE-2025-12450 Medium 6.1 LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting 0.4%
• CVE-2025-54939 Medium 5.3 LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. 0.8%
• CVE-2025-24947 Medium 5.3 A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a considerable CPU load on the server (a Hash 0.7%
• CVE-2024-9169 Medium 5.5 litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting 0.3%
• CVE-2024-3246 Medium 6.1 LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting 0.2%
• CVE-2023-4372 Medium 6.4 LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 19.5%