Executive brief
The LiteSpeed Cache plugin for WordPress, which is used to improve website performance, contains a security flaw that allows unauthorized individuals to inject malicious scripts into the site. This occurs because the plugin does not properly verify data received from external optimization services. If exploited, an attacker could redirect visitors to malicious websites, steal session information, or deface the website's front end.
Technical details
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the notify_ccss and notify_ucss REST API endpoints. These endpoints accept CSS content from QUIC.cloud callback notifications and store it to disk without sanitization; this content is later rendered inline on the frontend without output escaping. While the endpoints use IP-based access control, this validation can be bypassed if the site is behind a reverse proxy or CDN that is not configured to correctly handle source IP headers. An unauthenticated attacker can exploit this to inject arbitrary JavaScript into the site's CCSS/UCSS content. The issue is addressed in versions following 7.7.
Affected products
- LiteSpeed Technologies LiteSpeed Cache up to, and including, 7.7
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory
References
- https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/cloud.cls.php
- https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/css.cls.php
- https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/css.cls.php
- https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/optimize.cls.php
- https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/rest.cls.php
- https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/router.cls.php
- https://plugins.trac.wordpress.org/changeset/3473912/