The LiteSpeed Cache plugin for WordPress contains a stored Cross‑Site Scripting flaw that allows an unauthenticated attacker to inject arbitrary JavaScript via the /wp-json/litespeed/v1/notify_ccss and /wp-json/litespeed/v1/notify_ucss REST API endpoints. The flaw exists because CSS content received from QUIC.cloud callback notifications is written to disk without sanitization and later rendered inline on front‑end page loads without output escaping. This results in unauthorized execution of attacker‑supplied scripts in the context of site visitors.

WordPress sites running LiteSpeed Cache version 7.7 or older are affected. All installations that use the plugin and rely on the default REST API endpoints are vulnerable, regardless of other WordPress configuration changes.

The CVSS score is 7.2, indicating a high severity level. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation may be limited but remains a serious threat when the endpoint can be accessed. Attackers can exploit the flaw remotely by triggering the callback endpoints, potentially bypassing IP‑based access controls when the site is positioned behind a reverse proxy, load balancer, or CDN. Successful exploitation would allow domain‑at‑large user‑side code execution.