litespeedtech LiteSpeed Cache

• CVE-2026-93389 High 8.2 LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching 0.2%
• CVE-2026-116763 Medium 5.4 LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace) 0.3%
• CVE-2026-109215 Medium 6.4 LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization 0.3%
• CVE-2026-76579 Medium 4.7 LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter 0.4%
• CVE-2026-3129 Medium 6.4 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes 0.3%
• CVE-2026-18978 High 7.2 LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content 0.4%
• CVE-2026-3375 High 7.2 LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints 0.4%
• CVE-2025-12450 Medium 6.1 LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting 0.4%
• CVE-2024-9169 Medium 5.5 litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting 0.3%
• CVE-2024-3246 Medium 6.1 LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting 0.2%
• CVE-2023-4372 Medium 6.4 LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 19.5%