Stored Cross-Site Scripting Vulnerability in LiteSpeed Cache Plugin for WordPress

CVE-2023-4372

Summary

The LiteSpeed Cache plugin for WordPress contains a vulnerability that allows authenticated attackers with contributor-level permissions or higher to exploit inadequate input sanitization and output escaping in the 'esi' shortcode. This weakness enables them to inject malicious web scripts into pages, which are executed when users access those compromised pages. Versions up to and including 5.6 are affected, underscoring the importance of updating to protect against potential security breaches.

References