tadrik Free store check

Plugin security / LiteSpeed Cache

LiteSpeed Cache vulnerability: is your WooCommerce store affected?

LiteSpeed Cache has 10 serious security holes rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 27 August 2026. Every one is fixed: update to 7.9.1 or newer.

Short answer: your store is affected if it runs LiteSpeed Cache older than 7.9.1. Update to 7.9.1 or newer, on a copy of the store first if you can.

In our check of 3,600 live UK and US WooCommerce stores (31 October 2026 to 1 November 2026), 28 were running a version of LiteSpeed Cache with a serious hole that already had a fix. How we checked.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 7.9Fixed in 7.9Published 27 August 2026CVE-2026-18978

    Advisory: The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping.

  2. Server-side request forgery

    Someone could make your server send requests on their behalf.

    Score 7.2 (high)no login neededAffected: older than 7.9.1Fixed in 7.9.1Published 27 August 2026CVE-2026-84761

    Advisory: Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.

  3. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 7.8Fixed in 7.8Published 26 May 2026CVE-2026-3375

    Advisory: The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the /wp-json/litespeed/v1/notify_ccss and /wp-json/litespeed/v1/notify_ucss REST API endpoints in all versions up to, and...

  4. Privilege escalation

    A user could give themselves more rights, up to full admin.

    Score 8.1 (high)no login neededAffected: older than 6.5.2Fixed in 6.5.2Published 29 October 2024CVE-2024-50550

    Advisory: Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from n/a through <= 6.5.1.

  5. File access

    Someone could read files on your server they should never see.

    Score 8.8 (high)needs only a customer accountAffected: older than 6.5.1Fixed in 6.5.1Published 30 September 2024CVE-2024-47637

    Advisory: Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through <= 6.4.1.

  6. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 6.5.1Fixed in 6.5.1Published 30 September 2024CVE-2024-47374

    Advisory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from...

  7. Account takeover

    Someone could log in as another user, an admin included, without their password.

    Score 9.8 (critical)no login neededAffected: older than 6.5.0.1Fixed in 6.5.0.1Published 5 September 2024CVE-2024-44000

    Advisory: Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.

  8. Privilege escalation

    A user could give themselves more rights, up to full admin.

    Score 9.8 (critical)no login neededAffected: older than 6.4Fixed in 6.4Published 19 August 2024CVE-2024-28000

    Advisory: Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.

  9. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 8.3 (high)no login neededAffected: older than 5.7.0.1Fixed in 5.7.0.1Published 27 February 2024CVE-2023-40000

    Advisory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.

  10. Missing permission check

    An action that should need permission could be done without it.

    Score 8.2 (high)no login neededAffected: older than 5.7.0.1Fixed in 5.7.0.1Published 27 February 2024CVE-2023-45000

    Advisory: Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache.This issue affects LiteSpeed Cache: from n/a through 5.7.

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find LiteSpeed Cache. The version number is under its name. If it is lower than 7.9.1, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/litespeed-cache/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update LiteSpeed Cache to 7.9.1 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use LiteSpeed Cache.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use LiteSpeed Cache, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which LiteSpeed Cache version fixes it?
Version 7.9.1 or newer fixes all 10 issues on this page.
How do I know if my store is affected?
Your store is affected if it runs LiteSpeed Cache older than 7.9.1. In WordPress, open Plugins and read the version under LiteSpeed Cache. Without logging in, open yourstore.com/wp-content/plugins/litespeed-cache/readme.txt and read the Stable tag line.
I don't use LiteSpeed Cache any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.