The LiteSpeed Cache WordPress plugin suffers from a reflected XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. This flaw allows unauthenticated attackers to inject malicious scripts via crafted URLs, which execute when a victim interacts with the malicious link. The issue affects all versions up to 7.5.0.1. The CVSS 3.1 vector indicates the attack requires no privileges but does require user interaction, and it impacts confidentiality and integrity with no impact on availability. There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially compromising user confidentiality and integrity. This can be used for session hijacking, defacement, or other client-side attacks. There is no indication of availability impact or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links and consider disabling or limiting the use of the LiteSpeed Cache plugin. Monitoring vendor channels for updates is recommended.