Vendor
LiteSpeed Technologies
43 known vulnerabilities in products by LiteSpeed Technologies, 2 of them actively exploited (CISA KEV).
Key figures
43
Vulnerabilities
2
Actively exploited (KEV)
0
Used by ransomware
9
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-48172 | LiteSpeed cPanel Plugin Privilege Escalation Vulnerability In CISA KEValso in 1 other product | 9.8 | |
| Critical | CVE-2026-54420 | LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability In CISA KEValso in 1 other product | 8.5 | |
| Critical | CVE-2024-44000 | LiteSpeed Cache: Insufficiently Protected Credentials | 9.8 | |
| Critical | CVE-2024-28000 | WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability | 9.8 | |
| High | CVE-2023-40000 | WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability | 8.3 | |
| High | CVE-2022-0073 | Authenticated Remote Code Execution in OpenLiteSpeed Web Server | 8.8 | |
| Critical | CVE-2022-30592 | LSQUIC: security vulnerability | 9.8 | |
| Medium | CVE-2023-4372 | LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | 6.4 | |
| High | CVE-2021-26758 | LiteSpeed Technologies OpenLiteSpeed: Privilege Escalation | 8.8 | |
| High | CVE-2026-31386 | LiteSpeed Technologies OpenLiteSpeed: OS Command Injection | 7.2 | |
| High | CVE-2022-0074 | Privilege Escalation in OpenLiteSpeed Web Server | 8.8 | |
| Critical | CVE-2020-5519 | LiteSpeed Technologies OpenLiteSpeed: security vulnerability | 9.8 | |
| High | CVE-2024-47374 | WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability | 7.1 | |
| High | CVE-2026-115482 | LSQUIC: Allocation of Resources Without Limits or Throttling | 7.5 | |
| Critical | CVE-2026-93903 | Litespeedtech LiteSpeed Web Server: Double Decoding of the Same Data | — | |
| Not rated | CVE-2010-2333 | LiteSpeed Web Server: security vulnerability | — | |
| Critical | CVE-2024-50550 | WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability | 8.1 | |
| Not rated | CVE-2004-0112 | OpenSSL: Out-of-Bounds Read | — | |
| High | CVE-2026-18978 | LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content | 7.2 | |
| High | CVE-2024-47637 | WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability | 8.8 | |
| High | CVE-2015-3890 | LiteSpeed Technologies OpenLiteSpeed: Use-After-Free | 7.5 | |
| Medium | CVE-2018-19791 | LiteSpeed Technologies OpenLiteSpeed: security vulnerability | 6.5 | |
| Medium | CVE-2021-24964 | LiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSS | 6.1 | |
| Medium | CVE-2022-0072 | Directory Traversal in OpenLiteSpeed Web Server | 5.8 | |
| Medium | CVE-2026-104474 | OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update | 6.7 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 24sans-atrisk-mail,
- CISA warns of another cPanel plugin flaw exploited in attacksbleepingcomputer,
- CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalationthehackernews,
- Recent KEV Additions: LiteSpeed cPanel Plugin, Cisco Catalyst SD-WAN Manager, and Splunk Enterprisesans-newsbites-mail,
- LiteSpeed cPanel Plugin Privilege Escalation Exploitedsans-newsbites-mail,
- Fwd: @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 21sans-atrisk,
Products
| LiteSpeed Cache | 23 | 0 |
| LiteSpeed Technologies OpenLiteSpeed | 13 | 0 |
| LiteSpeed Web Server | 6 | 0 |
| LSQUIC | 5 | 0 |