Litespeedtech vulnerabilities
We track 12 vulnerabilities in Litespeedtech products across 6 products. 12 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on November 5, 2026.
Latest Litespeedtech vulnerabilities
- 8.2 High severity
LiteSpeed Cache: Exposure of Sensitive Information to an Unauthorized Actor
The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Sto
- 7.5 High severity
lsquic: Allocation of Resources Without Limits or Throttling
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_li
- 9.4 Critical severity
LiteSpeed Web Server: Double Decoding of the Same Data
LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged tenant execute code in the context of a different account.
- 7.2 High severity
LiteSpeed Cache: Improper Neutralization of Input During Web Page Generation
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke
- 8.5 High severity
LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Exploited
LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.
- 7.2 High severity
LiteSpeed Cache: Improper Neutralization of Input During Web Page Generation
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the /wp-json/litespeed/v1/notify_ccss and /wp-json/litespeed/v1/notify_ucss REST API endpoints in all versions up to, and including, 7.7. These endpoints accept CSS conte
- 9.8 Critical severity
LiteSpeed cPanel Plugin Privilege Escalation Exploited
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2
- 8.6 High severity
OpenLiteSpeed: Improper Neutralization of Special Elements used in an OS Command
OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.
- 9.8 Critical severity
LiteSpeed Cache: Insufficiently Protected Credentials
Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.
- 9.8 Critical severity
LiteSpeed Cache: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.
- 8.8 High severity
OpenLiteSpeed Web Server: Untrusted Search Path
Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. This affects versions from 1.6.15 before 1.7.16.1.
- 8.8 High severity
Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and…
Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. This affects 1.7.0 versions before 1.7.16.1.