Cross-site Scripting (XSS) Vulnerability in LiteSpeed Cache
CVE-2023-40000

8.3HIGH

Key Information:

Vendor
WordPress
Status
Litespeed Cache
Vendor
CVE Published:
16 April 2024

Badges

👾 Exploit Exists🟡 Public PoC📰 News Worthy

Summary

A security vulnerability exists in LiteSpeed Technologies' LiteSpeed Cache that enables an attacker to perform stored cross-site scripting (XSS) attacks. This flaw occurs due to improper handling of input during web page generation. When successfully exploited, the vulnerability can allow attackers to inject malicious scripts that may execute in the context of the user's browser session, leading to unauthorized actions or data theft. Affected versions include LiteSpeed Cache from n/a up to and including 5.7. Organizations using this software should assess their security posture to mitigate potential risks associated with this vulnerability.

Affected Version(s)

LiteSpeed Cache <= 5.7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

litespeed-cache-xss-poc
Created by quantiom

News Articles

favicon imageSC Media

WordPress sites targeted for hijacking with LiteSpeed Cache plugin flaw

More than 1.8 million WordPress sites using an old version of the LiteSpeed Cache plugin are at risk of takeovers amid attacks exploiting a high-severity unauthenticated cross-site scripting vulnerability, tracked as CVE-2023-40000, which have been increasing during the past month, according to Blee...

favicon imageThe Hacker News

Researchers Uncover Active Exploitation of WordPress Plugin Vulnerabilities

Researchers have discovered several vulnerabilities in popular WordPress plugins that allow attackers to create rogue admin accounts.

favicon imageThe Hacker News

Hackers Exploiting LiteSpeed Cache Bug to Gain Full Control of WordPress Sites

A critical flaw in the hugely popular LiteSpeed Cache plugin for WordPress is being exploited in the wild to create rogue admin accounts, granting att

References

https://patchstack.com/database/vulnerability/litespeed-c...
vdb-entry

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by The Hacker News

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.