CVE-2021-24964

CVE-2021-24964: LiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSS

Vendor Unknown
Product LiteSpeed Cache
Weakness CWE-79 · XSS
Published January 3, 2022
Last update May 22, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.

Key dates

02Disclosure timeline

January 3, 2022 CVE published
May 22, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-56019 WordPress Inline Footnotes Plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-32450 WordPress Active Products Tables for WooCommerce plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability CVE-2024-13587 Zigaform – Price Calculator & Cost Estimation Form Builder Lite <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-12214 WooCommerce HSS Extension for Streaming Video <= 3.31 - Reflected Cross-Site Scripting via videolink Parameter CVE-2024-34420 WordPress Comments Evolved for WordPress plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability