CVE-2026-3375

The LiteSpeed Cache plugin for WordPress contains a security flaw in its REST API endpoints for handling QUIC.cloud callback notifications. In versions up to and including 7.7, these endpoints fail to properly sanitize CSS content received from notifications before storing it on disk. This stored content is then rendered inline during frontend page loads without adequate output protection, allowing attackers to inject arbitrary JavaScript under specific deployment configurations involving reverse proxies or CDNs.

Based on public CVE data (MITRE/NVD).