LiteSpeed Cache Flaw (CVE-2025-12450): 7 Million WordPress Sites Exposed to XSS Attack

On 29 October 2025, a security flaw in the LiteSpeed Cache for WordPress (LSCWP) plugin, tracked as CVE-2025-12450, was disclosed, exposing about 7 million WordPress sites to a reflected XSS attack. The vulnerability is described as a Reflected XSS flaw that could allow unauthenticated attackers to steal sensitive user data or hijack user sessions. The flaw was responsibly discovered and reported by Nicholas Giemsa at Trustwave, according to Trustwave.

Affected versions include all releases up to and including 7.5.0.1, with a patched version available in 7.6 or newer. The plugin is widely used for site acceleration and includes features like server‑level caching and image optimisation, amplifying the risk posed by this XSS flaw given the plugin’s large install base. Users are urged to update the plugin to mitigate potential exploitation, particularly to protect high‑privilege users such as site administrators.