Cross-Site Scripting in LiteSpeed Cache WebP Image Replacement

Skrevet den af i LiteSpeed Cache

LiteSpeed Cache rewrites image URLs inside the data-settings attribute of the page buffer when serving WebP images. The rewritten JSON was written back without being fully HTML-encoded, so an attacker who can influence an image URL or the surrounding markup could break out of the attribute and inject arbitrary JavaScript that executes in the browser of any visitor to the affected page.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1
  • LiteSpeed Cache 6.4
  • LiteSpeed Cache 6.4.1
  • LiteSpeed Cache 6.5
  • LiteSpeed Cache 6.5.0.1
  • LiteSpeed Cache 6.5.0.2
  • LiteSpeed Cache 6.5.1
  • LiteSpeed Cache 6.5.2
  • LiteSpeed Cache 6.5.3
  • LiteSpeed Cache 6.5.4
  • LiteSpeed Cache 7.0
  • LiteSpeed Cache 7.0.0.1
  • LiteSpeed Cache 7.0.1
  • LiteSpeed Cache 7.1
  • LiteSpeed Cache 7.2
  • LiteSpeed Cache 7.3
  • LiteSpeed Cache 7.3.0.1
  • LiteSpeed Cache 7.4
  • LiteSpeed Cache 7.5
  • LiteSpeed Cache 7.5.0.1
  • LiteSpeed Cache 7.6
  • LiteSpeed Cache 7.6.1
  • LiteSpeed Cache 7.6.2
  • LiteSpeed Cache 7.7
  • LiteSpeed Cache 7.8
  • LiteSpeed Cache 7.8.0.1
  • LiteSpeed Cache 7.8.1

Stored cross-site scripting via snsanitized css content in ucss/ccss generation

Skrevet den af i LiteSpeed Cache

LiteSpeed Cache for WordPress versions up to and including 7.7 are vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization of CSS content before it is saved to static files on the server.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 3.6.4
  • LiteSpeed Cache 4.0
  • LiteSpeed Cache 4.1
  • LiteSpeed Cache 4.2
  • LiteSpeed Cache 4.3
  • LiteSpeed Cache 4.4
  • LiteSpeed Cache 4.4.1
  • LiteSpeed Cache 4.4.2
  • LiteSpeed Cache 4.4.3
  • LiteSpeed Cache 4.4.4
  • LiteSpeed Cache 4.4.5
  • LiteSpeed Cache 4.4.6
  • LiteSpeed Cache 4.4.7
  • LiteSpeed Cache 4.5
  • LiteSpeed Cache 4.5.0.1
  • LiteSpeed Cache 4.6
  • LiteSpeed Cache 5.0
  • LiteSpeed Cache 5.0.0.1
  • LiteSpeed Cache 5.0.1
  • LiteSpeed Cache 5.1
  • LiteSpeed Cache 5.2
  • LiteSpeed Cache 5.2.1
  • LiteSpeed Cache 5.3
  • LiteSpeed Cache 5.3.1
  • LiteSpeed Cache 5.3.2
  • LiteSpeed Cache 5.3.3
  • LiteSpeed Cache 5.4
  • LiteSpeed Cache 5.5
  • LiteSpeed Cache 5.5.1
  • LiteSpeed Cache 5.6
  • LiteSpeed Cache 5.7
  • LiteSpeed Cache 5.7.0.1
  • LiteSpeed Cache 6.0
  • LiteSpeed Cache 6.0.0.1
  • LiteSpeed Cache 6.1
  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1
  • LiteSpeed Cache 6.4
  • LiteSpeed Cache 6.4.1
  • LiteSpeed Cache 6.5
  • LiteSpeed Cache 6.5.0.1
  • LiteSpeed Cache 6.5.0.2
  • LiteSpeed Cache 6.5.1
  • LiteSpeed Cache 6.5.2
  • LiteSpeed Cache 6.5.3
  • LiteSpeed Cache 6.5.4
  • LiteSpeed Cache 7.0
  • LiteSpeed Cache 7.0.0.1
  • LiteSpeed Cache 7.0.1
  • LiteSpeed Cache 7.1
  • LiteSpeed Cache 7.2
  • LiteSpeed Cache 7.3
  • LiteSpeed Cache 7.3.0.1
  • LiteSpeed Cache 7.4
  • LiteSpeed Cache 7.5
  • LiteSpeed Cache 7.5.0.1
  • LiteSpeed Cache 7.6
  • LiteSpeed Cache 7.6.1
  • LiteSpeed Cache 7.6.2
  • LiteSpeed Cache 7.7

Authenticated (contributor+) stored cross-site scripting in multiple pages

Skrevet den af i LiteSpeed Cache

Insufficient input sanitization and output escaping makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 3.6.4
  • LiteSpeed Cache 4.0
  • LiteSpeed Cache 4.1
  • LiteSpeed Cache 4.2
  • LiteSpeed Cache 4.3
  • LiteSpeed Cache 4.4
  • LiteSpeed Cache 4.4.1
  • LiteSpeed Cache 4.4.2
  • LiteSpeed Cache 4.4.3
  • LiteSpeed Cache 4.4.4
  • LiteSpeed Cache 4.4.5
  • LiteSpeed Cache 4.4.6
  • LiteSpeed Cache 4.4.7
  • LiteSpeed Cache 4.5
  • LiteSpeed Cache 4.5.0.1
  • LiteSpeed Cache 4.6
  • LiteSpeed Cache 5.0
  • LiteSpeed Cache 5.0.0.1
  • LiteSpeed Cache 5.0.1
  • LiteSpeed Cache 5.1
  • LiteSpeed Cache 5.2
  • LiteSpeed Cache 5.2.1
  • LiteSpeed Cache 5.3
  • LiteSpeed Cache 5.3.1
  • LiteSpeed Cache 5.3.2
  • LiteSpeed Cache 5.3.3
  • LiteSpeed Cache 5.4
  • LiteSpeed Cache 5.5
  • LiteSpeed Cache 5.5.1
  • LiteSpeed Cache 5.6
  • LiteSpeed Cache 5.7
  • LiteSpeed Cache 5.7.0.1
  • LiteSpeed Cache 6.0
  • LiteSpeed Cache 6.0.0.1
  • LiteSpeed Cache 6.1
  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1
  • LiteSpeed Cache 6.4
  • LiteSpeed Cache 6.4.1
  • LiteSpeed Cache 6.5
  • LiteSpeed Cache 6.5.0.1
  • LiteSpeed Cache 6.5.0.2
  • LiteSpeed Cache 6.5.1
  • LiteSpeed Cache 6.5.2

Authenticated (editor+) server-side request forgery in different sections

Skrevet den af i LiteSpeed Cache

Server-side request forgery available in many modules. This makes it possible for authenticated attackers, with Editor-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 3.6.4
  • LiteSpeed Cache 4.0
  • LiteSpeed Cache 4.1
  • LiteSpeed Cache 4.2
  • LiteSpeed Cache 4.3
  • LiteSpeed Cache 4.4
  • LiteSpeed Cache 4.4.1
  • LiteSpeed Cache 4.4.2
  • LiteSpeed Cache 4.4.3
  • LiteSpeed Cache 4.4.4
  • LiteSpeed Cache 4.4.5
  • LiteSpeed Cache 4.4.6
  • LiteSpeed Cache 4.4.7
  • LiteSpeed Cache 4.5
  • LiteSpeed Cache 4.5.0.1
  • LiteSpeed Cache 4.6
  • LiteSpeed Cache 5.0
  • LiteSpeed Cache 5.0.0.1
  • LiteSpeed Cache 5.0.1
  • LiteSpeed Cache 5.1
  • LiteSpeed Cache 5.2
  • LiteSpeed Cache 5.2.1
  • LiteSpeed Cache 5.3
  • LiteSpeed Cache 5.3.1
  • LiteSpeed Cache 5.3.2
  • LiteSpeed Cache 5.3.3
  • LiteSpeed Cache 5.4
  • LiteSpeed Cache 5.5
  • LiteSpeed Cache 5.5.1
  • LiteSpeed Cache 5.6
  • LiteSpeed Cache 5.7
  • LiteSpeed Cache 5.7.0.1
  • LiteSpeed Cache 6.0
  • LiteSpeed Cache 6.0.0.1
  • LiteSpeed Cache 6.1
  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1
  • LiteSpeed Cache 6.4
  • LiteSpeed Cache 6.4.1
  • LiteSpeed Cache 6.5
  • LiteSpeed Cache 6.5.0.1
  • LiteSpeed Cache 6.5.0.2
  • LiteSpeed Cache 6.5.1
  • LiteSpeed Cache 6.5.2
  • LiteSpeed Cache 6.5.3
  • LiteSpeed Cache 6.5.4
  • LiteSpeed Cache 7.0
  • LiteSpeed Cache 7.0.0.1
  • LiteSpeed Cache 7.0.1

Unauthenticated Sensitive Information Exposure via Debug Log Files

Skrevet den af i LiteSpeed Cache

Patch removes all debug-level logging of HTTP response headers and request cookies, disables the “Log Cookies” option entirely, and relocates debug files into a hard-to-guess directory (/wp-content/litespeed/debug/) with randomized filenames based on the site’s AUTH_KEY. It also adds an index.php to block directory listings and updates .htaccess to deny direct access to log files, fully preventing unauthenticated attackers from downloading sensitive data.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 3.6.4
  • LiteSpeed Cache 4.0
  • LiteSpeed Cache 4.1
  • LiteSpeed Cache 4.2
  • LiteSpeed Cache 4.3
  • LiteSpeed Cache 4.4
  • LiteSpeed Cache 4.4.1
  • LiteSpeed Cache 4.4.2
  • LiteSpeed Cache 4.4.3
  • LiteSpeed Cache 4.4.4
  • LiteSpeed Cache 4.4.5
  • LiteSpeed Cache 4.4.6
  • LiteSpeed Cache 4.4.7
  • LiteSpeed Cache 4.5
  • LiteSpeed Cache 4.5.0.1
  • LiteSpeed Cache 4.6
  • LiteSpeed Cache 5.0
  • LiteSpeed Cache 5.0.0.1
  • LiteSpeed Cache 5.0.1
  • LiteSpeed Cache 5.1
  • LiteSpeed Cache 5.2
  • LiteSpeed Cache 5.2.1
  • LiteSpeed Cache 5.3
  • LiteSpeed Cache 5.3.1
  • LiteSpeed Cache 5.3.2
  • LiteSpeed Cache 5.3.3
  • LiteSpeed Cache 5.4
  • LiteSpeed Cache 5.5
  • LiteSpeed Cache 5.5.1
  • LiteSpeed Cache 5.6
  • LiteSpeed Cache 5.7
  • LiteSpeed Cache 5.7.0.1
  • LiteSpeed Cache 6.0
  • LiteSpeed Cache 6.0.0.1
  • LiteSpeed Cache 6.1
  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1
  • LiteSpeed Cache 6.4
  • LiteSpeed Cache 6.4.1

Authenticated (Administrator+) stored cross-site scripting

Skrevet den af i LiteSpeed Cache

Due to insufficient input sanitization and output escaping, authenticated attackers with administrator-level permissions or higher can inject arbitrary web scripts into pages, which will execute whenever a user accesses an affected page.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 3.6.4
  • LiteSpeed Cache 4.0
  • LiteSpeed Cache 4.1
  • LiteSpeed Cache 4.2
  • LiteSpeed Cache 4.3
  • LiteSpeed Cache 4.4
  • LiteSpeed Cache 4.4.1
  • LiteSpeed Cache 4.4.2
  • LiteSpeed Cache 4.4.3
  • LiteSpeed Cache 4.4.4
  • LiteSpeed Cache 4.4.5
  • LiteSpeed Cache 4.4.6
  • LiteSpeed Cache 4.4.7
  • LiteSpeed Cache 4.5
  • LiteSpeed Cache 4.5.0.1
  • LiteSpeed Cache 4.6
  • LiteSpeed Cache 5.0
  • LiteSpeed Cache 5.0.0.1
  • LiteSpeed Cache 5.0.1
  • LiteSpeed Cache 5.1
  • LiteSpeed Cache 5.2
  • LiteSpeed Cache 5.2.1
  • LiteSpeed Cache 5.3
  • LiteSpeed Cache 5.3.1
  • LiteSpeed Cache 5.3.2
  • LiteSpeed Cache 5.3.3
  • LiteSpeed Cache 5.4
  • LiteSpeed Cache 5.5
  • LiteSpeed Cache 5.5.1
  • LiteSpeed Cache 5.6
  • LiteSpeed Cache 5.7
  • LiteSpeed Cache 5.7.0.1
  • LiteSpeed Cache 6.0
  • LiteSpeed Cache 6.0.0.1
  • LiteSpeed Cache 6.1
  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1
  • LiteSpeed Cache 6.4
  • LiteSpeed Cache 6.4.1

Unauthenticated privilege escalation via is_role_simulation()

Skrevet den af i LiteSpeed Cache

The is_role_simulation() function lacks proper authorization checks, allowing unauthenticated attackers to simulate privileged roles (e.g., Administrator), potentially granting them elevated access to the site.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 4.0
  • LiteSpeed Cache 4.1
  • LiteSpeed Cache 4.2
  • LiteSpeed Cache 4.3
  • LiteSpeed Cache 4.4
  • LiteSpeed Cache 4.4.1
  • LiteSpeed Cache 4.4.2
  • LiteSpeed Cache 4.4.3
  • LiteSpeed Cache 4.4.4
  • LiteSpeed Cache 4.4.5
  • LiteSpeed Cache 4.4.6
  • LiteSpeed Cache 4.4.7
  • LiteSpeed Cache 4.5
  • LiteSpeed Cache 4.5.0.1
  • LiteSpeed Cache 4.6
  • LiteSpeed Cache 5.0
  • LiteSpeed Cache 5.0.0.1
  • LiteSpeed Cache 5.0.1
  • LiteSpeed Cache 5.1
  • LiteSpeed Cache 5.2
  • LiteSpeed Cache 5.2.1
  • LiteSpeed Cache 5.3
  • LiteSpeed Cache 5.3.1
  • LiteSpeed Cache 5.3.2
  • LiteSpeed Cache 5.3.3
  • LiteSpeed Cache 5.4
  • LiteSpeed Cache 5.5
  • LiteSpeed Cache 5.5.1
  • LiteSpeed Cache 5.6
  • LiteSpeed Cache 5.7
  • LiteSpeed Cache 5.7.0.1
  • LiteSpeed Cache 6.0
  • LiteSpeed Cache 6.0.0.1
  • LiteSpeed Cache 6.1
  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1
  • LiteSpeed Cache 6.4
  • LiteSpeed Cache 6.4.1
  • LiteSpeed Cache 6.5
  • LiteSpeed Cache 6.5.0.1
  • LiteSpeed Cache 6.5.0.2
  • LiteSpeed Cache 6.5.1

Authenticated (Contributor+) Stored Cross-Site Scripting

Skrevet den af i LiteSpeed Cache

Due to insufficient input sanitization and output escaping, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which will execute whenever a user accesses an affected page.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 3.6.4
  • LiteSpeed Cache 4.0
  • LiteSpeed Cache 4.1
  • LiteSpeed Cache 4.2
  • LiteSpeed Cache 4.3
  • LiteSpeed Cache 4.4
  • LiteSpeed Cache 4.4.1
  • LiteSpeed Cache 4.4.2
  • LiteSpeed Cache 4.4.3
  • LiteSpeed Cache 4.4.4
  • LiteSpeed Cache 4.4.5
  • LiteSpeed Cache 4.4.6
  • LiteSpeed Cache 4.4.7
  • LiteSpeed Cache 4.5
  • LiteSpeed Cache 4.5.0.1
  • LiteSpeed Cache 4.6
  • LiteSpeed Cache 5.0
  • LiteSpeed Cache 5.0.0.1
  • LiteSpeed Cache 5.0.1
  • LiteSpeed Cache 5.1
  • LiteSpeed Cache 5.2
  • LiteSpeed Cache 5.2.1
  • LiteSpeed Cache 5.3
  • LiteSpeed Cache 5.3.1
  • LiteSpeed Cache 5.3.2
  • LiteSpeed Cache 5.3.3
  • LiteSpeed Cache 5.4
  • LiteSpeed Cache 5.5
  • LiteSpeed Cache 5.5.1
  • LiteSpeed Cache 5.6
  • LiteSpeed Cache 5.7
  • LiteSpeed Cache 5.7.0.1
  • LiteSpeed Cache 6.0
  • LiteSpeed Cache 6.0.0.1
  • LiteSpeed Cache 6.1
  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1
  • LiteSpeed Cache 6.4
  • LiteSpeed Cache 6.4.1
  • LiteSpeed Cache 6.5
  • LiteSpeed Cache 6.5.0.1
  • LiteSpeed Cache 6.5.0.2

Unauthenticated Privilege Escalation

Skrevet den af i LiteSpeed Cache

The plugin fails to properly restrict the role simulation functionality, allowing attackers to spoof their user ID as an administrator if they obtain or brute force a valid hash, potentially found in debug logs. This vulnerability enables unauthenticated attackers to create new administrator accounts via the `/wp-json/wp/v2/users` REST API endpoint.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 4.0
  • LiteSpeed Cache 4.1
  • LiteSpeed Cache 4.2
  • LiteSpeed Cache 4.3
  • LiteSpeed Cache 4.4
  • LiteSpeed Cache 4.4.1
  • LiteSpeed Cache 4.4.2
  • LiteSpeed Cache 4.4.3
  • LiteSpeed Cache 4.4.4
  • LiteSpeed Cache 4.4.5
  • LiteSpeed Cache 4.4.6
  • LiteSpeed Cache 4.4.7
  • LiteSpeed Cache 4.5
  • LiteSpeed Cache 4.5.0.1
  • LiteSpeed Cache 4.6
  • LiteSpeed Cache 5.0
  • LiteSpeed Cache 5.0.0.1
  • LiteSpeed Cache 5.0.1
  • LiteSpeed Cache 5.1
  • LiteSpeed Cache 5.2
  • LiteSpeed Cache 5.2.1
  • LiteSpeed Cache 5.3
  • LiteSpeed Cache 5.3.1
  • LiteSpeed Cache 5.3.2
  • LiteSpeed Cache 5.3.3
  • LiteSpeed Cache 5.4
  • LiteSpeed Cache 5.5
  • LiteSpeed Cache 5.5.1
  • LiteSpeed Cache 5.6
  • LiteSpeed Cache 5.7
  • LiteSpeed Cache 5.7.0.1
  • LiteSpeed Cache 6.0
  • LiteSpeed Cache 6.0.0.1
  • LiteSpeed Cache 6.1
  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1