LiteSpeed Cache <= 4.4.3 - Authorization Bypass

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE CVE-2021-24964
CVSS Medium (6.5)
Publicly Published November 30, 2021
Last Updated January 22, 2024
Researcher Emil Kylander
Description

The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.

References

1 affected software package

Software Type Plugin
Software Slug litespeed-cache (view on wordpress.org)
Patched? Yes
Affected Version
  • 1.0.15 - 4.4.3
Patched Version
  • 4.4.4
This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.
License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. License Detail.