--- title: "LiteSpeed Technologies vulnerabilities: CVEs, CISA KEV and security advisories" url: https://radicalnotion.ai/vendor/litespeedtechnologies type: vendor description: "LiteSpeed Technologies has 22 published CVEs, 2 in CISA KEV and 12 with public exploits." updated: 2026-09-03 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # LiteSpeed Technologies vulnerabilities - **Published CVEs:** 22 - **In CISA KEV:** 2 - **With a public exploit:** 12 - **With a patch:** 18 - **Average CVSS:** 7.8 - **CVEs in the last two years:** 8 - **First CVE:** 2005-11-20 - **Latest CVE:** 2026-09-03 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 4 | | High | 11 | | Medium | 7 | | Low | 0 | | Unscored | 0 | ## Most affected products | Product | CVEs | | --- | --- | | [LiteSpeed Cache](https://radicalnotion.ai/vendor/litespeedtechnologies/litespeed-cache) | 12 | | [LiteSpeed Web Server](https://radicalnotion.ai/vendor/litespeedtechnologies/litespeed-web-server) | 5 | | [OpenLiteSpeed Web Server](https://radicalnotion.ai/vendor/litespeedtechnologies/openlitespeed-web-server) | 3 | | [OpenLiteSpeed](https://radicalnotion.ai/vendor/litespeedtechnologies/openlitespeed) | 2 | | [cPanel Plugin](https://radicalnotion.ai/vendor/litespeedtechnologies/cpanel-plugin) | 2 | | [WHM Plugin](https://radicalnotion.ai/vendor/litespeedtechnologies/whm-plugin) | 1 | | [LiteSpeed Web Server Enterprise](https://radicalnotion.ai/vendor/litespeedtechnologies/litespeed-web-server-enterprise) | 1 | | [LSWS Enterprise](https://radicalnotion.ai/vendor/litespeedtechnologies/lsws-enterprise) | 1 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation | 5 | | [CWE-266](https://radicalnotion.ai/cwe/cwe-266) | Incorrect Privilege Assignment | 3 | | [CWE-78](https://radicalnotion.ai/cwe/cwe-78) | Improper Neutralization of Special Elements used in an OS Command | 2 | | [CWE-918](https://radicalnotion.ai/cwe/cwe-918) | Server-Side Request Forgery | 2 | | [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery | 1 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 1 | | [CWE-522](https://radicalnotion.ai/cwe/cwe-522) | Insufficiently Protected Credentials | 1 | | [CWE-61](https://radicalnotion.ai/cwe/cwe-61) | UNIX Symbolic Link (Symlink) Following | 1 | ## Assigning CNAs | CNA | CVEs | | --- | --- | | [Patchstack](https://radicalnotion.ai/cna/patchstack) | 12 | | [mitre](https://radicalnotion.ai/cna/mitre) | 4 | | [palo\_alto](https://radicalnotion.ai/cna/palo-alto) | 3 | | [VulnCheck](https://radicalnotion.ai/cna/vulncheck) | 2 | | [jpcert](https://radicalnotion.ai/cna/jpcert) | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2022 | 3 | | 2023 | 1 | | 2024 | 8 | | 2025 | 1 | | 2026 | 7 | ## Latest CVEs | CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-84761 | WordPress LiteSpeed Cache plugin \<= 7.9 - Server Side Request Forgery (SSRF) vulnerability | high | 7.2 | 0.3% | No | 2026-09-03 | | CVE-2026-54420 | LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability | high | 8.5 | 1.4% | Yes | 2026-06-14 | | CVE-2026-48172 | LiteSpeed cPanel Plugin Privilege Escalation Vulnerability | critical | 10.0 | 17.9% | Yes | 2026-05-21 | | CVE-2026-31386 | OpenLiteSpeed and LSWS Enterprise vulnerable to OS command injection | high | 8.6 | 1.6% | No | 2026-03-16 | | CVE-2024-51915 | WordPress LiteSpeed Cache plugin \<= 6.5.2 - Cross Site Scripting (XSS) vulnerability | medium | 6.5 | 0.3% | No | 2026-02-20 | | CVE-2021-47903 | LiteSpeed Web Server Enterprise 5.4.11 - Command Injection | high | 8.6 | 1.6% | No | 2026-01-23 | | CVE-2021-47855 | Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting | medium | 5.1 | 0.3% | No | 2026-01-21 | | CVE-2025-47437 | WordPress LiteSpeed Cache plugin \<= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability | medium | 6.4 | 0.3% | No | 2025-09-09 | | CVE-2024-50550 | WordPress LiteSpeed Cache plugin \<= 6.5.1 - Privilege Escalation vulnerability | critical | 9.8 | 0.9% | No | 2024-10-29 | | CVE-2024-44000 | WordPress LiteSpeed Cache plugin \< 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability | critical | 9.8 | 82.3% | No | 2024-10-20 | | CVE-2024-47637 | WordPress LiteSpeed Cache plugin \<= 6.4.1 - Path Traversal vulnerability | high | 8.8 | 0.6% | No | 2024-10-16 | | CVE-2024-47373 | WordPress LiteSpeed Cache plugin \<= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability | medium | 6.5 | 0.3% | No | 2024-10-05 | ## Frequently asked questions ### How many CVEs does LiteSpeed Technologies have? LiteSpeed Technologies has 22 published CVE records since 2005, including 8 in the last two years. ### How many LiteSpeed Technologies CVEs are in CISA KEV? 2 of LiteSpeed Technologies's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline. ### Which LiteSpeed Technologies products have the most CVEs? The LiteSpeed Technologies products with the most published CVEs are LiteSpeed Cache, LiteSpeed Web Server, OpenLiteSpeed Web Server, OpenLiteSpeed, cPanel Plugin. ### What are the most common weakness types in LiteSpeed Technologies CVEs? LiteSpeed Technologies's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation), CWE-266 (Incorrect Privilege Assignment), CWE-78 (Improper Neutralization of Special Elements used in an OS Command), CWE-918 (Server-Side Request Forgery). ### Are there public exploits for LiteSpeed Technologies vulnerabilities? Yes — 12 of LiteSpeed Technologies's CVEs have a known public exploit. ### How many critical LiteSpeed Technologies vulnerabilities are there? LiteSpeed Technologies has 4 critical and 11 high-severity CVEs. ### What is the average severity of LiteSpeed Technologies CVEs? The average CVSS base score across LiteSpeed Technologies's scored CVEs is 7.8. ## Related vendors - [Microsoft](https://radicalnotion.ai/vendor/microsoft) (48,490 CVEs) - [Linux](https://radicalnotion.ai/vendor/linux) (26,121 CVEs) - [Google](https://radicalnotion.ai/vendor/google) (18,541 CVEs) - [Apple](https://radicalnotion.ai/vendor/apple) (15,953 CVEs) - [Oracle](https://radicalnotion.ai/vendor/oracle) (14,426 CVEs) - [Debian](https://radicalnotion.ai/vendor/debian) (10,245 CVEs) - [IBM](https://radicalnotion.ai/vendor/ibm) (9,857 CVEs) - [Red Hat](https://radicalnotion.ai/vendor/red-hat) (8,789 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/litespeedtechnologies). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.