# CVE-2026-3375: LiteSpeed Cache Stored XSS in REST API endpoints

Source: https://junglewise.ai/threats/cve-2026-3375-litespeed-cache-stored-xss-in-rest-api-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-3375 · Severity: high · CVSS 7.2 · Published 2026-05-27

The LiteSpeed Cache plugin for WordPress, which is used to improve website performance, contains a security flaw that allows unauthorized individuals to inject malicious scripts into the site. This occurs because the plugin does not properly verify data received from external optimization services. If exploited, an attacker could redirect visitors to malicious websites, steal session information, or deface the website's front end.

Vendors: [LiteSpeed Technologies](https://junglewise.ai/threats/vendors/litespeed-technologies).

## Quick answers

**Is CVE-2026-3375 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3375 being exploited in the wild.

**How severe is CVE-2026-3375?** High severity, with a CVSS score of 7.2, published 27 May 2026.

**Which products and versions are affected?** LiteSpeed Technologies LiteSpeed Cache up to, and including, 7.7.

**Is there a fix for CVE-2026-3375?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-3375 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-3375?** Check whether you run LiteSpeed Technologies LiteSpeed Cache at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the notify_ccss and notify_ucss REST API endpoints. These endpoints accept CSS content from QUIC.cloud callback notifications and store it to disk without sanitization; this content is later rendered inline on the frontend without output escaping. While the endpoints use IP-based access control, this validation can be bypassed if the site is behind a reverse proxy or CDN that is not configured to correctly handle source IP headers. An unauthenticated attacker can exploit this to inject arbitrary JavaScript into the site's CCSS/UCSS content. The issue is addressed in versions following 7.7.

## Affected products

- LiteSpeed Technologies LiteSpeed Cache up to, and including, 7.7

## Timeline

- 2026-05-27: disclosed
- 2026-05-27: advisory

## References

- [https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/cloud.cls.php](https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/cloud.cls.php)
- [https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/css.cls.php](https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/css.cls.php)
- [https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/css.cls.php](https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/css.cls.php)
- [https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/optimize.cls.php](https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/optimize.cls.php)
- [https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/rest.cls.php](https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/rest.cls.php)
- [https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/router.cls.php](https://plugins.trac.wordpress.org/browser/litespeed-cache/trunk/src/router.cls.php)
- [https://plugins.trac.wordpress.org/changeset/3473912/](https://plugins.trac.wordpress.org/changeset/3473912/)

## Related threats

- [LiteSpeed Cache WordPress plugin stored XSS in VPI](https://junglewise.ai/threats/cve-2026-109215-the-litespeed-cache-plugin-for-wordpress-is-vulnerable-to-stored)