CVE-2025-12450

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-12450
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12450.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-12450
Published
2025-10-29T09:27:57.311Z
Modified
2026-07-15T01:49:05.245974753Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting
Details

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 7.5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12450.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "Wordfence"
}
References

Affected packages

Git / github.com/litespeedtech/lscache_wp

Affected ranges

Type
GIT
Repo
https://github.com/litespeedtech/lscache_wp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3d473f44d37ec2a834162ff1d86c017e9ae67db3
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.5.0.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

5.*
5.4
v1.*
v1.2.2
v1.2.3.1
v1.3.1.1
v1.5
v1.6.7
v1.7.2
v4.*
v4.3
v4.4.7
v4.5.0.1
v4.6
v5.*
v5.0
v5.0.1
v5.1
v5.2
v5.2.1
v5.3.1
v5.3.2
v5.3.3
v5.5
v5.7.0.1
v6.*
v6.3.0.1
v6.4.1
v6.5
v6.5.0.1
v6.5.0.2
v6.5.1
v7.*
v7.1
v7.2
v7.3
v7.3.0.1
v7.4
v7.5
v7.5.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12450.json"