Exposición de Litespeed Cache

Caching, WordPress plugins
40
score de exposición
400.357
sitios usan
0
en explotación
2
críticos
Análisis Vexday

O plugin Litespeed Cache acumula 18 CVEs catalogadas, com 2 classificadas como críticas e nenhuma entrada no catálogo CISA KEV, taxa que fica abaixo da média geral do catálogo. Apesar da ausência de exploração confirmada pelo KEV, o CVE-2024-44000 apresenta EPSS de 0,83, valor elevado que indica probabilidade substancial de exploração ativa segundo os modelos preditivos — merecendo atenção prioritária em ambientes que utilizam esse plugin. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que frequentemente serve de vetor para sequestro de sessão e injeção de conteúdo malicioso em páginas WordPress. A presença de uma CVE surgida nos últimos 90 dias indica que a superfície de ataque segue em expansão recente, reforçando a necessidade de manutenção contínua de atualizações.

CVEs

18 resultados
CVE-2024-44000CRITICALWordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerabilityEPSS 82.1%CVE-2024-28000CRITICALWordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerabilityEPSS 68.3%CVE-2023-40000HIGHWordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerabilityEPSS 54.9%CVE-2023-4372MEDIUMLiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 19.7%CVE-2024-47374HIGHWordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 1.4%CVE-2021-24964MEDIUMLiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSSEPSS 1.2%CVE-2024-50550HIGHWordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerabilityEPSS 0.9%CVE-2021-24963—LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site ScriptingEPSS 0.7%CVE-2024-47637HIGHWordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerabilityEPSS 0.7%CVE-2023-45000HIGHWordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerabilityEPSS 0.4%CVE-2025-12450MEDIUMLiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-3375HIGHLiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API EndpointsEPSS 0.4%CVE-2024-9169MEDIUMlitespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2022-46800MEDIUMWordPress LiteSpeed Cache Plugin <= 5.3 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2024-47373MEDIUMWordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-51915MEDIUMWordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-47437MEDIUMWordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.2%CVE-2024-3246MEDIUMLiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.2%