More than five million WordPress sites could be compromised due to an unauthenticated site-wide cross-site scripting flaw in the LiteSpeed Cache plugin, tracked as CVE-2023-40000, which could be exploited to facilitate privilege escalation attacks, according to The Hacker News. Inadequate user input sanitization and escaping output have caused the vulnerability, which has been addressed in an October update but could be abused through a single HTTP request, a report from Patchstack showed.

Source: SC Magazine