The LiteSpeed Cache plugin for WordPress contains a reflected cross‑site scripting flaw caused by inadequate sanitization of user input and missing output escaping. The vulnerability allows an attacker to embed arbitrary JavaScript into a page that will execute when a victim follows a crafted link. Because the flaw is triggered solely by incoming URLs, authentication is not required and any eligible user of a vulnerable WordPress site can be targeted.

All WordPress sites that run LiteSpeed Cache version 7.5.0.1 or older are affected. The issue is located within the LiteSpeed Cache plugin distributed by LiteSpeed Technologies and can impact any WordPress installation that has not upgraded beyond the mentioned version.

The CVSS score of 6.1 reflects moderate exploitability and potential impact. EPSS indicates a very low probability of exploitation (<1%), and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not actively exploited in the wild as of the last update. The attack vector inferred is via a user clicking a maliciously crafted URL, which then causes the victim’s browser to execute injected script. No additional privileges or system access are required.