In the specific LiteSpeed vulnerability, the implementation of a shortcode functionality allowed a malicious hacker to upload scripts they otherwise would not be able to had the proper security protocols of sanitization/escaping data been in place.

this story makes no sense, Wordfence told them in August 2023 about this and they “released a patch” the next day, but why did it take until October 2023 before this patch was released on WordPress.org for the LS Cache plugin

4 Million WordPress Sites affected by Stored Cross-Site Scripting Vulnerability in LiteSpeed Cache Plugin

“We contacted The LiteSpeed Cache Team on August 14, 2023, and we received a response on the same day. After providing full disclosure details, the developer team made a patch on August 16, 2023, and released it to the WordPress repository on October 10, 2023. We would like to commend the LiteSpeed Technologies for their prompt response and timely patch.”

a classic WordPress Christmas story! lol never ends….

don’t worry, the dumbasses who use the LS Cache plugin won’t even notice because they also have Elementor and Rank Math installed

impossible to know for sure which plugin caused their site to get hacked! 💯

strange indeed

Litespeed flew too close to the sun……..