Security readout for executives and security teams
Plain-English summary
This vulnerability lets a logged-in WordPress user with Contributor or higher rights store malicious script through LiteSpeed Cache shortcode handling. The script can run when someone views the affected page. It is not a remote unauthenticated takeover issue, but it can create business risk where low-privilege authors can publish or submit content.
Executive priority
Treat as a normal-priority web application patch unless the site allows many contributors or untrusted content workflows. Prioritize faster if marketing, publishing, or agency users have Contributor access, because stored XSS can affect visitors or administrators who view injected pages.
Technical view
CVE-2023-4372 is stored XSS in LiteSpeed Cache for WordPress through the esi shortcode in versions up to and including 5.6. The source attributes the issue to insufficient sanitization and output escaping of user-supplied shortcode attributes. CVSS 3.1 is 6.4: network reachable, low complexity, low privileges, scope changed, low confidentiality and integrity impact.
Likely exposure
Exposure is most likely on WordPress sites running LiteSpeed Cache 5.6 or earlier, especially where Contributor, Author, Editor, or Administrator accounts are shared, numerous, compromised, or assigned to third parties.
Exploitation context
The CVE source says exploitation requires an authenticated user with contributor-level or higher permissions. The bundle does not indicate CISA KEV listing or active exploitation. Impact depends on whether an attacker can place affected shortcode content where higher-value users or visitors will load it.
Researcher notes
The key technical issue is shortcode attribute handling in LiteSpeed Cache ESI code. Public references include historical source, vendor commit, and WordPress.org changeset. The provided bundle does not include proof-of-concept details, confirmed exploitation, or a named fixed version, so avoid claims beyond 5.6-and-earlier exposure.
Mitigation direction
- Upgrade LiteSpeed Cache beyond the affected 5.6-and-earlier range using vendor guidance.
- Review WordPress accounts with Contributor or higher roles and remove unnecessary access.
- Audit pages and posts using LiteSpeed Cache esi shortcode content.
- For custom forks, apply vendor sanitization and output-escaping changes.
- Monitor for unexpected scripts or content changes in contributor-authored pages.
Validation and detection
- Inventory WordPress sites using the LiteSpeed Cache plugin.
- Confirm each plugin version is newer than the affected 5.6-and-earlier range.
- Review user roles for Contributor or higher permissions.
- Search content for esi shortcode usage requiring security review.
- Check vendor advisories or Wordfence entry for fixed-version confirmation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-4372 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N3.12.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/27026f0f-c85e-4409-9973-4b9cb8a90da5?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/5.5.1/src/esi.cls.php#L480CVE reference
- https://github.com/litespeedtech/lscache_wp/commit/95a407d9f192b37ac6cf96d2aa50f240e3e6b2d7#diff-7b2c514b58d1b8a71655607bdfab87cedb013bc1b8927ce0b49a89ddf4a7e01cR495CVE reference
- https://plugins.trac.wordpress.org/changeset/2977143/litespeed-cache#file348CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.