CVE-2026-3375: LiteSpeed Cache WordPress Plugin XSS Flaw

CVE-2026-3375 Overview

CVE-2026-3375 is a stored cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin for WordPress, affecting all versions up to and including 7.7. The flaw resides in the /wp-json/litespeed/v1/notify_ccss and /wp-json/litespeed/v1/notify_ucss REST API endpoints. These endpoints accept Critical CSS (CCSS) and Unique CSS (UCSS) content from QUIC.cloud callback notifications and write it to disk without sanitization. Stored content is later rendered inline on frontend page loads without output escaping. Access control relies on IP-based validation, which can be bypassed when WordPress runs behind a reverse proxy, load balancer, or CDN with certain configurations [CWE-79].

Critical Impact
Unauthenticated attackers can inject arbitrary JavaScript that executes in the browser of every visitor to affected pages, enabling session theft, credential harvesting, and administrative account compromise.

Affected Products

LiteSpeed Cache plugin for WordPress, all versions up to and including 7.7
WordPress sites deployed behind reverse proxies, load balancers, or CDNs with permissive IP forwarding configurations
Sites integrating QUIC.cloud CCSS and UCSS optimization services

Discovery Timeline

2026-05-27 - CVE-2026-3375 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-3375

Vulnerability Analysis

The LiteSpeed Cache plugin exposes two REST API endpoints used by the QUIC.cloud backend to deliver generated CSS optimizations. When QUIC.cloud finishes building Critical CSS or Unique CSS for a page, it issues a callback to notify_ccss or notify_ucss containing the generated stylesheet. The plugin writes the received payload to disk in the site's CSS cache directory. On subsequent page renders, the plugin inlines that cached content directly into the HTML response. Because the payload is treated as trusted CSS, no sanitization or output escaping is applied at either the write or render stage.

Root Cause

The root cause is the combination of missing input sanitization on REST input and missing output escaping at render time. The plugin assumes inbound content originates from QUIC.cloud and is structurally valid CSS. An attacker who reaches the endpoint can submit a payload that includes HTML or <script> markup. When the file is inlined into a page response, the browser parses the injected markup and executes attacker-controlled JavaScript in the site's origin.

Attack Vector

Access to the vulnerable endpoints is restricted by an IP allowlist matched against the request source address. In deployments where the WordPress site sits behind a reverse proxy, load balancer, or CDN, the application may derive the client IP from forwarded headers such as X-Forwarded-For or X-Real-IP. If these headers are not authenticated or sanitized by the upstream proxy, an unauthenticated remote attacker can spoof the QUIC.cloud source IP and reach notify_ccss or notify_ucss. The attacker then submits a payload that breaks out of the CSS context using constructs such as </style><script> followed by malicious JavaScript. The injected code executes for every visitor whose page request triggers inlining of the poisoned CCSS or UCSS file.

Refer to the Wordfence Vulnerability Report and the WordPress ChangeSet #3473912 for the patch diff. Relevant source locations include cloud.cls.php#L2085, css.cls.php#L401, css.cls.php#L595, optimize.cls.php#L477, rest.cls.php#L108, and router.cls.php#L732.

Detection Methods for CVE-2026-3375

Indicators of Compromise

Unexpected POST requests to /wp-json/litespeed/v1/notify_ccss or /wp-json/litespeed/v1/notify_ucss from source addresses outside the documented QUIC.cloud IP ranges
Cached CSS files in the LiteSpeed Cache directory containing HTML tags, <script> elements, or JavaScript event handlers such as onerror and onload
Outbound requests from visitor browsers to unfamiliar third-party domains shortly after loading pages that inline CCSS or UCSS content
WordPress administrator session anomalies, including new admin accounts or unauthorized plugin installations following anomalous REST traffic

Detection Strategies

Inspect cached CSS files for any non-CSS content using regular expressions that flag angle brackets, script, or javascript: substrings
Correlate X-Forwarded-For header values with actual upstream proxy IPs to identify spoofed client addresses targeting the notify endpoints
Apply web application firewall rules that block requests to the two REST routes unless the connection originates from validated QUIC.cloud infrastructure

Monitoring Recommendations

Alert on any write to the LiteSpeed CSS cache directory that contains markup characters or scripting keywords
Monitor WordPress REST API access logs for unauthenticated POST traffic to notify_ccss and notify_ucss and baseline expected volume
Track frontend Content Security Policy (CSP) violation reports that indicate inline script execution from the site's own origin

How to Mitigate CVE-2026-3375

Immediate Actions Required

Update the LiteSpeed Cache plugin to the patched release that supersedes version 7.7, as published in WordPress ChangeSet #3473912
Purge all cached CCSS and UCSS files to remove any payloads that may already be stored on disk
Audit WordPress administrator accounts, sessions, and recently installed plugins or themes for signs of post-exploitation activity
Restrict the notify_ccss and notify_ucss endpoints at the web server or WAF layer to only the published QUIC.cloud source IP ranges

Patch Information

The vendor addressed the issue in the LiteSpeed Cache plugin release following version 7.7. The fix is tracked in WordPress ChangeSet #3473912 and introduces sanitization of inbound CSS payloads, output escaping at render time, and tightened source validation for the notify endpoints. Site operators should apply the update through the WordPress plugin manager or WP-CLI immediately.

Workarounds

Configure the upstream reverse proxy or CDN to strip incoming X-Forwarded-For and X-Real-IP headers before forwarding requests to WordPress
Disable the QUIC.cloud CCSS and UCSS optimization features in LiteSpeed Cache settings until the patched version is deployed
Deploy a restrictive Content Security Policy that disallows inline scripts to reduce the impact of injected payloads

bash

# Example NGINX configuration restricting the LiteSpeed notify endpoints
# to QUIC.cloud source ranges and stripping client-supplied forwarding headers
location ~ ^/wp-json/litespeed/v1/(notify_ccss|notify_ucss)$ {
    # Replace with the current published QUIC.cloud IP ranges
    allow 192.0.2.0/24;
    deny all;

    proxy_set_header X-Forwarded-For "";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_pass http://wordpress_upstream;
}