Skip to content
Threat Feed

Vendor

LiteSpeed

1 brief RSS
medium advisory

LiteSpeed Cache Plugin Stored XSS Vulnerability (CVE-2026-3375)

The LiteSpeed Cache plugin for WordPress is vulnerable to stored Cross-Site Scripting (XSS) via the /wp-json/litespeed/v1/notify_ccss and /wp-json/litespeed/v1/notify_ucss REST API endpoints, affecting versions up to 7.7, allowing unauthenticated attackers to inject arbitrary JavaScript into CCSS/UCSS content by bypassing IP-based access controls.

LiteSpeed Cache plugin for WordPress cve xss wordpress litespeed plugin
1r 1t 1c