Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| LiteSpeed Technologies | LiteSpeed Cache | ≤ 5.7 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
rxerium/CVE-2023-40000 ★ 7 · Feb 28, 2024
LiteSpeed Cache plugin for WordPress that could enable unauthenticated users to escalate their privileges
-
quantiom/litespeed-cache-xss-poc ★ 5 · May 12, 2024
PoC for XSS vulnerability in the LiteSpeed Cache WordPress plugin (CVE-2023-40000) allowing elevated privileges. Includes code, explanations, and mitigations.
-
iveresk/cve-2023-40000 ★ 1 · May 13, 2024
That's a PoC of cve-2023-40000. Wordpress LiteSpeed Cache exploit.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS http/cves/2023/CVE-2023-40000.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.