CVE-2025-12450mediumexplotación observadaCWE-79

CVE-2025-12450: fallo de gravedad media en litespeedtech LiteSpeed Cache

LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear LiteSpeed Cache

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

35Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Attendcvss 6.1epss 0.4%
de la publicación al arma
Publicada en NVD29 oct
VulnCheck29 oct
The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 7.5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
litespeedtech · LiteSpeed Cache
CVEs relacionadas — litespeedtech LiteSpeed Cache

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-4372MEDIUMLiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 19.5%CVE-2026-18978HIGHLiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.4%CVE-2026-76579MEDIUMLiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' ParameterEPSS 0.4%CVE-2026-3375HIGHLiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API EndpointsEPSS 0.4%CVE-2026-116763MEDIUMLiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)EPSS 0.3%CVE-2026-109215MEDIUMLiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-SerializationEPSS 0.3%