CVE-2021-47855 - CVE House

Back to Database

Status published Medium CVE-2021-47855

Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting

5.1 CVSS

Vulnerability Description

Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripts. Attackers can craft a payload in the Notes field during listener configuration that will execute when an administrator clicks on the Default Icon.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-47855

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

cmOs

References

More from LiteSpeed Technologies

View All →

WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability

WordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerability

WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability

WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability

WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability

Affected Vendor

LiteSpeed Technologies

View all reports →

Affected Software

OpenLiteSpeed

Vulnerable Versions:

1.7.9

Timeline

Official Publish: January 21st, 2026

Last Modified: March 5th, 2026

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement