WordPress LiteSpeed Plugin Vulnerability Puts 5 Million Sites at Risk

A stored cross-site scripting vulnerability (CVE-2023-40000) in the LiteSpeed Cache WordPress plugin can allow unauthenticated users to inject admin notices and achieve privilege escalation or data theft; the issue is due to missing input sanitization/escaping in update_cdn_status() and was fixed in version 5.7.0.1 (Oct 2023). The plugin has over five million installations, increasing potential exposure, though the report does not provide evidence of active exploitation.