LiteSpeed Cache Plugin Stores Unsanitized CSS via REST API

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the /wp-json/litespeed/v1/notify_ccss and /wp-json/litespeed/v1/notify_ucss REST API endpoints in all versions up to, and including, 7.7. These endpoints accept CSS content from QUIC.cloud callback notifications and store it to disk without sanitization. The stored content is later rendered inline frontend page loads without output escaping. The access control protecting these endpoints is IP-based validation that can potentially be bypassed when the WordPress site is deployed behind a reverse proxy, load balancer, or CDN with certain configurations. This makes it possible for unauthenticated attackers, under certain conditions, to inject arbitrary JavaScript into CCSS/UCSS content.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The LiteSpeed Cache plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its REST API endpoints that handle CSS notifications from QUIC.cloud. Attackers can inject malicious scripts through the /wp-json/litespeed/v1/notify_ccss and /wp-json/litespeed/v1/notify_ucss endpoints, which accept and store CSS content without sanitization. Because the stored content is rendered inline on frontend page loads without output escaping, any visitor to the affected WordPress site becomes a potential victim. This affects all versions up to 7.7 of a widely-used caching plugin, making this a high-impact vulnerability (CVSS 7.2) that threatens WordPress administrators and their site visitors with account compromise, credential theft, and malware distribution.

Casky's 301 mapped skills leverage Claude AI's extended reasoning to detect the attack patterns associated with TA0001 (Initial Access) and TA0043 (Reconnaissance) techniques underlying this vulnerability. Security practitioners using Casky would identify suspicious patterns including: REST API calls to litespeed notification endpoints with CSS payloads containing script tags or event handlers; stored file modifications in cache directories with unsanitized content; and subsequent HTTP responses that inline malicious CSS without escaping special characters. The platform's skills would flag discrepancies between expected CSS content and actual stored payloads, detect IP-based access control bypasses or spoofing attempts targeting QUIC.cloud callbacks, and correlate frontend page rendering with injected script execution—enabling practitioners to spot compromise attempts before malware reaches end users.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-3375.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-3375

Casky has 301 skills that investigate the attack patterns behind CVE-2026-3375. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn