CVE-2023-40000

high-risk

Published 2024-04-16

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.

Do I need to act?

82.8% chance of exploitation in next 30 days

EPSS score — higher than 17% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.3/10 High

NETWORK / LOW complexity

Affected Products (1)

Litespeed Cache

Affected Vendors

Litespeedtech

References (3)

Third Party Advisory https://patchstack.com/database/vulnerability/litespeed-cache/wordpress-litespee...

Exploit https://github.com/rxerium/CVE-2023-40000

/ 100

high-risk

Severity 29/34 · Critical

Exploitability 20/34 · Moderate

Exposure 5/34 · Minimal