CVE-2021-24964: fallo de gravedad media en LiteSpeed Cache
LiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSS
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 1.2%
The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
Unknown · LiteSpeed CacheCVEs relacionadas — LiteSpeed Cache
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-24963—LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site ScriptingEPSS 0.7%CVE-2026-113500HIGHLiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display OptimizationEPSS 0.3%CVE-2026-113499HIGHLiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS RewritingEPSS 0.3%CVE-2026-113501LOWLiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice DismissalEPSS 0.2%