LiteSpeed Cache is a performance plugin, not a security one, and yet its history includes three vulnerabilities exploited by attackers and two account takeovers rated 9.8. From December 2020 to October 15, 2026, the WPScan database attributes 23 vulnerabilities to it. Here is the verified timeline, what each major vulnerability allowed and the habits that protect a site, even when the fix is slow to be installed.
LiteSpeed Cache in brief
LiteSpeed Cache (slug litespeed-cache) has been published since January 2016 by LiteSpeed Technologies, the company behind the LiteSpeed web server and the QUIC.cloud CDN. It claims more than 7 million active installations on wordpress.org, which places it among the most widespread plugins. Server-level page caching requires a LiteSpeed server or QUIC.cloud, but the optimization features (CSS and JavaScript minification and combination, critical CSS, image lazy loading, image optimization, database cleanup) work on any server, Apache and Nginx included.
This scope explains its attack surface. To rewrite every page, the plugin parses and modifies the HTML, including content supplied by visitors (comments, HTTP headers). To talk to QUIC.cloud, it exposes endpoints that receive data from outside. And to warm up the cache of members-only pages, its crawler could impersonate a logged-in user. Each of these mechanisms has produced at least one serious vulnerability.
Timeline of vulnerabilities, from 2020 to October 2026
The counts below use the WPScan database, from December 26, 2020 to October 15, 2026: 23 vulnerabilities, 11 of them published in 2024, and none in 2022. Patchstack lists the same number of entries. The table includes the 14 most significant vulnerabilities (exploitable without an account, exploited or rated high); the others are summarized right after.
| Published | Fixed in | Type | CVSS | CVE | Account required | Exploitation |
|---|---|---|---|---|---|---|
| November 30, 2021 | 4.4.4 | IP check bypass, then stored XSS | 8.1 | CVE-2021-24964 | None | None documented |
| February 27, 2024 | 5.7.0.1 | Site-wide stored XSS | 8.3 (WPScan 8.8) | CVE-2023-40000 | None | Yes, April 2024 (WPScan) |
| February 27, 2024 | 5.7.0.1 | Missing access control (CDN status) | 8.2 (WPScan 5.3) | CVE-2023-45000 | None | None documented |
| July 23, 2024 | 6.3 | CSRF leading to stored XSS | 6.1 | CVE-2024-3246 | None (an administrator must click) | None documented |
| August 21, 2024 | 6.4 | Privilege escalation | 9.8 (WPScan 8.1) | CVE-2024-28000 | None | Yes, at large scale from August 2024 (Wordfence) |
| September 5, 2024 | 6.5.0.1 | Account takeover via the debug log | 9.8 (WPScan 7.5) | CVE-2024-44000 | None | Attacks observed in 2026 (F5 Labs) |
| September 30, 2024 | 6.5.1 | Stored XSS via an HTTP header | 7.1 (WPScan 6.1) | CVE-2024-47374 | None | None documented |
| September 30, 2024 | 6.5.1 | Directory traversal | 8.8 (WPScan 4.3) | CVE-2024-47637 | Author (according to WPScan) | None documented |
| October 29, 2024 | 6.5.2 | Privilege escalation (role simulation) | 8.1 | CVE-2024-50550 | None | None documented |
| October 28, 2025 | 7.6 | Reflected XSS | 6.1 (WPScan 7.1) | CVE-2025-12450 | None (crafted link) | None documented |
| May 26, 2026 | 7.8 | Stored XSS via the QUIC.cloud endpoints | 7.2 | CVE-2026-3375 | None | None documented |
| August 27, 2026 | 7.9 | Stored XSS via a comment | 7.2 | CVE-2026-18978 | None | None documented |
| September 2, 2026 | 7.9.1 | Server-side request forgery (SSRF) | 7.2 (WPScan 5.8) | CVE-2026-84761 | None | None documented |
| September 18, 2026 | 7.9.1 | Reflected XSS via the esi parameter | 4.7 | CVE-2026-76579 | None (crafted link) | None documented |
The nine other vulnerabilities require an account or an action by an administrator. In 2020, an XSS in the server IP setting, limited to administrators (3.6.1). In 2021, a reflected XSS in an admin page (4.4.4). In 2023, a CSRF fixed in 5.3.1 and a contributor stored XSS via the esi shortcode (5.7). In 2024, an administrator stored XSS in the debug settings (6.5), and two stored XSS reachable by contributors (6.5.1 and 6.5.3). In 2025, an SSRF reachable by an editor (7.1). In 2026, an author stored XSS via image attributes (7.8).
The notable vulnerabilities explained
CVE-2023-40000: an XSS fixed in 2023, exploited in 2024
Reported on October 17, 2023 by Rafie Muhammad (Patchstack), this vulnerability was fixed as early as version 5.7.0.1 of October 25, 2023, but was only made public on February 27, 2024. The function that updates the CDN status accepted unauthenticated data and displayed it again in an admin notice without escaping. An anonymous visitor could therefore slip JavaScript into it, which then ran in an administrator's browser.
On May 3, 2024, WPScan described a wave of attacks against sites still below 5.7.0.1, peaking on April 2, 2024. The injected script created administrator accounts named wpsupp-user or wp-configuser, and a single IP address had sent more than 1.2 million reconnaissance requests. The lesson is clear: the fix had been available for more than five months, and the affected sites were those that did not update the plugin.
August to October 2024: the three takeovers
These three vulnerabilities are detailed in our article on LiteSpeed Cache privilege escalations in 2024; in short:
- CVE-2024-28000 (9.8 according to Patchstack): the token that let the crawler simulate a user relied on about one million possible values, few enough to be guessed by brute force, then used to create an administrator. Reported on August 1, 2024 by John Blackbourn ($14,400 bounty via Patchstack), fixed in 6.4 on August 13, published on August 21. Wordfence was blocking more than 48,500 attacks in 24 hours the next day, according to BleepingComputer.
- CVE-2024-44000 (9.8): when the debug log was enabled, it recorded session cookies in a publicly readable file. Fixed in 6.5.0.1 on September 4, 2024. In July 2026, F5 Labs still ranked it eighth among the most attacked vulnerabilities in June 2026, with 2,603 attacks observed during the month.
- CVE-2024-50550 (8.1): a new variant of the role simulation, exploitable only with certain crawler settings. Version 6.5.2 of October 17, 2024 removed the role simulation feature.
CVE-2024-47374: an HTTP header to inject script
Reported on September 24, 2024 by researcher TaiYou through the Patchstack program, this stored XSS went through the X-LSCACHE-VARY-VALUE header, copied without sanitization into the CSS generation queue. A single anonymous HTTP request was enough, but only if two settings that are off by default were enabled: "CSS Combine" and "Generate UCSS". The vendor sent a fix the same day and released version 6.5.1 on September 25: one day between the report and the fix.
2021 and 2026: the same trap around QUIC.cloud
In November 2021, Emil Kylander showed that the plugin checked the origin of QUIC.cloud calls based on the IP address, and that a simple X-Forwarded-For header was enough to impersonate the service. Combined with an endpoint that saved CSS, this resulted in an unauthenticated stored XSS (fixed in 4.4.4). In May 2026, CVE-2026-3375 repeated the pattern: the notify_ccss and notify_ucss REST endpoints stored CSS received from QUIC.cloud without sanitization, and the IP check could be bypassed behind some reverse proxies, load balancers or CDNs. Reported on February 28, 2026, it is fixed in 7.8 (March 3, 2026). Version 7.9.1 of September 1, 2026 changed approach: according to the changelog, all QUIC.cloud calls are now verified by a signature rather than by the source IP address.
August and September 2026: comments and forged requests
CVE-2026-18978, reported by Jack Taylor and published on August 27, 2026, let a visitor inject script through a comment made up entirely of numeric character references, placed in an allowed tag such as code: this content escaped WordPress filtering (wp_kses) and reached a vulnerable function of the plugin. The site had to automatically publish comments from previously approved authors and not require name and email (fixed in 7.9, on August 5, 2026). CVE-2026-84761, published on September 2, is an unauthenticated SSRF: the plugin could be made to send requests to addresses chosen by the attacker, including internal ones (fixed in 7.9.1). Finally, CVE-2026-76579, published on September 18, is a reflected XSS via the esi parameter, which requires getting someone to click a crafted link (7.9.1).
To avoid any confusion: the two LiteSpeed vulnerabilities added to the CISA KEV catalog in 2026 (CVE-2026-48172 on May 26, CVE-2026-54420 on June 15) concern LiteSpeed's cPanel plugin for hosting providers, not the WordPress plugin. No LiteSpeed Cache vulnerability appears in this catalog.
What this history shows
- XSS vulnerabilities dominate. 14 of the 23 entries are XSS (15 with the CSRF leading to XSS), including five unauthenticated stored XSS. A plugin that rewrites the HTML of every page inevitably handles untrusted content.
- Internal trust mechanisms are the real weak spot. Role simulation token, debug log, QUIC.cloud IP check: the most severe vulnerabilities come from shortcuts that are convenient for performance but insufficiently protected.
- Fixes are fast. One day for CVE-2024-47374, eight days for CVE-2023-40000, twelve days for CVE-2024-28000. The vendor runs an active disclosure program with Patchstack.
- Attacks target the laggards. CVE-2023-40000 was exploited more than five months after its fix, and CVE-2024-44000 was still among the most attacked vulnerabilities nearly two years after its own.
- A performance plugin deserves the same care as a security plugin. It runs on every page and receives data from visitors, which makes it just as much of a target.
This pace is nothing unusual for such widespread software: our timeline of WordPress core security releases and our article on XSS vulnerabilities in WordPress provide points of comparison.
Protecting your site
- Check the version in Plugins: 7.9.1 or later fixes all the vulnerabilities listed here.
- Turn on automatic updates for LiteSpeed Cache (see our guide to automatic plugin updates). The 2024 attacks hit sites that were months behind.
- Check for traces of old vulnerabilities: unknown administrator accounts (including
wpsupp-userandwp-configuser), an olddebug.logfile to delete, sessions to end if a log containing cookies was public. - Only enable the options you need: the debug log just for the time of a diagnosis, and advanced CSS optimizations only if you measure the gain. If you are not on a LiteSpeed server and do not use its optimizations, another cache plugin may be enough; remove the ones you no longer use (abandoned and unnecessary plugins).
- Add a web application firewall capable of virtual patching (WAF comparison): Patchstack, for example, deployed a rule for CVE-2024-47374 on the day of the report.
- Monitor published vulnerabilities for your plugins (monitoring plugin vulnerabilities).
WP Masquerade Pro can help with this last point. Every day, it compares the installed versions of your plugins and themes with the public WPVulnerability.net database and sends you a vulnerability alert by email, with the severity and the fixed version. Pending updates and vulnerable sites appear in the member area (site monitoring), and the integrity check flags modified core files, which is useful after a compromise. WP Masquerade does not fix vulnerabilities and is not a firewall: it warns you, and the update is still yours to apply.
Key takeaways
- 23 vulnerabilities published in WPScan from December 2020 to October 15, 2026, 11 of them in 2024.
- Three were exploited according to recognized sources: CVE-2023-40000, CVE-2024-28000 and CVE-2024-44000.
- The attacks targeted sites that had not applied a fix available for months.
- Minimum recommended version as of October 15, 2026: 7.9.1.
- Automatic updates, options limited to what is necessary and vulnerability monitoring remain the best defenses.
Sources
- WordPress.org: LiteSpeed Cache, full changelog (external link, opens in a new tab)
- NVD: CVE-2024-44000 (October 20, 2024) (external link, opens in a new tab)
- NVD: CVE-2024-50550 (October 29, 2024) (external link, opens in a new tab)
- CISA: Known Exploited Vulnerabilities Catalog (external link, opens in a new tab)
Other sources consulted: further CVE records, official vendor pages, security research publications, trade press articles, WPScan and Patchstack databases.
Update, October 28, 2026: on October 21, 2026, WPScan published two unauthenticated stored XSS vulnerabilities in LiteSpeed Cache (CVE-2026-113499 and CVE-2026-113500, rated 7.5), fixed in 7.9.2. They only affect sites that use certain settings (CDN rewriting or font display optimization) and accept comments. Full details: LiteSpeed Cache: two unauthenticated XSS flaws, patch in 7.9.2.
