Litespeedtech Litespeed Cpanel Plugin — known CVE vulnerabilities

Every CVE whose affected-product data names Litespeedtech Litespeed Cpanel Plugin, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (2)

• CVE-2026-48172 — CVSS 9.8 (critical) — actively exploited: LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026…
• CVE-2026-54420 — CVSS 8.5 (high) — actively exploited: LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with…