Most Exploited Internet-Facing Products

MEIFP

Back to Ranking

LiteSpeed Technologies

Products: LiteSpeed Cache · WHM Plugin · cPanel Plugin

62.6

Score

4

CVEs

2

Active

2

PoC

2

KEV

#47

Rank

Period:

Product:

CVE ID	Published	CVSS	Exploit	KEV	AC	PR	Auto	Score(hover)	Affected Products	Description
CVE-2026-54420	2026-06-14	8.5v3.1	ACTIVE		High	Low	no	22.0	cPanel Plugin	LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.
CVE-2026-48172	2026-05-21	10.0v4.0	ACTIVE		Low	None	YES	40.6	cPanel PluginWHM Plugin	LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output
CVE-2024-28000	2024-08-21	9.8v3.1	POC	—	Low	None	YES	0.0	LiteSpeed Cache	Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.
CVE-2023-40000	2024-04-16	8.3v3.1	POC	—	Low	None	no	0.0	LiteSpeed Cache	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.

Each CVE: 10 pts base (Active only), boosted by:

KEV×2.0AC: Low×1.2PR: None×1.3PR: Low×1.1Auto×1.3