UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2021-24964

LiteSpeed Cache: Cross-site Scripting

Severity
Medium 6.1
Published
30 Nov 2021
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
4.4.4
Also known as
WPV-85e19d7e7e5c
Sources
NVD, WPVulnerability

Description

The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped.…

Affected software

SoftwareAffected versions
LiteSpeed CacheServers and applications · cpe:a:litespeedtech:litespeed_cache
  • Every version before 4.4.4
LiteSpeed CacheWordPress plugins · wp-plugin:litespeed-cache
  • Every version before 4.4.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-24964
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-24964
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/litespeed-cache/litespeed-cache-443-authorization-bypass