LiteSpeed Cache

Reviewers keep praising the speed gains, with just a few noting overwhelming settings on first setup and a missing option to add third-party CDN keys.

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

2099 searches this plugin appeared in over the last 90 days, 20 listed. 1955 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 19 months ago; a band this size takes about a year or more to cross, which places it about 90% of the way through.

1. ★★★★★ jreygarcia1960

   4mo ago

   I was used to the typical optimization plugins. I was pleasantly surprised by the power of this wonderful plugin. Without a doubt, it’s a leader in WordPress optimization.

   Read on wp.org ↗
2. ★★★★★ EddyTarantulo

   4mo ago

   So like… this LiteSpeed Cache plugin totally showed up and just started handling business, man. My page used to take 1.12 seconds to load, which, okay, not forever, but this plugin was like “nah dude, we can do better” and cranked it down to 0.29 seconds. That’s a 74% glow-up, man. Practically instant. Blink and it’s already loaded, mazing! And the PageSpeed score? Went from a chill 66 to a straight-up 92. That’s a 28% bump, dude. My site went from “eh, it’s fine I guess” to “whoa, are you a professional now?” Perfect score!

   Read on wp.org ↗
3. ★★★★★ gamao

   4mo ago

   I tried this out to see if it would help with my site speed and it’s honestly great. It made a noticeable difference in performance right away and everything runs so much smoother now. Super happy with it.

   Read on wp.org ↗
4. ★★★★★ mohamedabdelrazek

   4mo ago

   Speed Boost fr Real

   Read on wp.org ↗
5. ★★★★★ lefort50

   4mo ago

   nice application easy to use to make a website smooth-running website

   Read on wp.org ↗
6. ★★★★★ narratorben

   4mo ago

   Litespeed cache is a great plugin.however recent versions have started to do that annoying and needy thing where it asks why you are deactivating it every time you deactivate it. For a caching plugin it gets deactivated a lot as sometimes I need to see the site without caching and this just adds an extra annoying step. Would be 5 stars if it didn’t do that!

   Read on wp.org ↗
7. ★★★★★ WebHostPro

   5mo ago

   If your host runs LiteSpeed servers, this is the caching plugin to use. With the free CDN option included, it is pretty much a no-brainer. If your host does not use LiteSpeed, I would probably go with a different caching plugin. Luckily, at Web Host Pro, we always run LiteSpeed and always use this plugin. It works great, stays fast, and makes WordPress caching simple. This topic was modified 1 month ago by WebHostPro. Reason: typo

   Read on wp.org ↗
8. ★★★★★ yusefclass

   5mo ago

   Simple rules, reliable purges, and very noticeable speed gains.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 7.8.1 CDN Fixed Cloudflare API key type detection for the compatibility w/ the new key format. 7.8.1
2. — Version 7.8.0.1 Object Cache Improved Object Cache resilience: auto disable when connection fails, network subsites fallback to database, and dropped TTL setting to respect never-expired transients. 7.8.0.1
3. — Version 7.8 Cloud Changed Health service to run asynchronously. Object Cache Dropped Store Transients option. Transients now always use Object Cache when available, preventing potential database bloat from expired transients not bei 7.8
4. — Version 7.7 Task Increased default cron interval from 1 minute to 15 minutes. Conf Enabled litespeed_conf_load_option_{$option} to allow modifying configuration values. Conf Removed deprecated O_MEDIA_PRELOAD_FEATURED option. GUI Da 7.7
5. — Version 7.6.2 🐞 Cloud Fixed the PHP 8+ typecast issue in QUIC.cloud signature verification which caused activation failures. Purge Restored a delay purge hook while calling purge by CLI. (asafm7) REST Dropped legacy code that had bee 7.6.2
6. — Version 7.6.1 Cloud Increased POST connection timeout to prevent potential failures. ⚠️🐞 GUI Fixed a frontend display issue caused by the dark mode CSS file loading on the website frontend. (Peter Wells PR#923) 🐞 Page Optimize Corre 7.6.1

All 29 disclosed vulnerabilities are patched in the current version (7.9.2). Sites still on an older version should update.

1. Patched Medium · 6.4 LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization ↗
   2026-10-28 CVE-2026-109215 Improper Neutralization of Input During Web Page Generation Affects <= 7.9.1 Patched in 7.9.2
2. Patched Medium · 5.4 LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace) ↗
   2026-10-28 CVE-2026-116763 Improper Neutralization of Input During Web Page Generation Affects <= 7.9.1 Patched in 7.9.2
3. Patched High · 7.2 LiteSpeed Cache < 7.9.2 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-10-23 CVE-2026-113500 Improper Neutralization of Input During Web Page Generation Affects < 7.9.2 Patched in 7.9.2
4. Patched Medium · 4.3 LiteSpeed Cache < 7.9.2 - Missing Authorization ↗
   2026-10-23 CVE-2026-113501 Missing Authorization Affects < 7.9.2 Patched in 7.9.2
5. Patched High · 7.2 LiteSpeed Cache < 7.9.2 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-10-23 CVE-2026-113499 Improper Neutralization of Input During Web Page Generation Affects < 7.9.2 Patched in 7.9.2
6. Patched Medium · 5.3 LiteSpeed Cache <= 7.9 - Unauthenticated Information Exposure ↗
   2026-10-22 CVE-2026-114190 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.9 Patched in 7.9.1
7. Patched Medium · 4.7 LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter ↗
   2026-09-18 CVE-2026-76579 Improper Neutralization of Input During Web Page Generation Affects <= 7.9 Patched in 7.9.1
8. Patched High · 7.2 LiteSpeed Cache <= 7.9 - Unauthenticated Server-Side Request Forgery ↗
   2026-09-02 CVE-2026-84761 Server-Side Request Forgery Affects <= 7.9 Patched in 7.9.1
9. Patched High · 7.2 LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content ↗
   2026-08-27 CVE-2026-18978 Improper Neutralization of Input During Web Page Generation Affects <= 7.8.1 Patched in 7.9
10. Patched Medium · 6.4 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes ↗
    2026-08-27 CVE-2026-3129 Improper Neutralization of Input During Web Page Generation Affects <= 7.7 Patched in 7.8
11. Patched High · 7.2 LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints ↗
    2026-05-26 CVE-2026-3375 Improper Neutralization of Input During Web Page Generation Affects <= 7.7 Patched in 7.8
12. Patched Medium · 6.1 LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting ↗
    2025-10-28 CVE-2025-12450 Improper Neutralization of Input During Web Page Generation Affects <= 7.5.0.1 Patched in 7.6
13. Patched Medium · 5.5 LiteSpeed Cache <= 7.0.1 - Authenticated (Editor+) Server-Side Request Forgery ↗
    2025-05-07 CVE-2025-47437 Server-Side Request Forgery Affects <= 7.0.1 Patched in 7.1
14. Patched Medium · 6.4 LiteSpeed Cache <= 6.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-12-20 CVE-2024-51915 Improper Neutralization of Input During Web Page Generation Affects <= 6.5.2 Patched in 6.5.3
15. Patched High · 8.1 LiteSpeed Cache <= 6.5.1 - Unauthenticated Privilege Escalation ↗
    2024-10-29 CVE-2024-50550 Incorrect Privilege Assignment Affects <= 6.5.1 Patched in 6.5.2
16. Patched Medium · 4.3 LiteSpeed Cache <= 6.4.1 - Authenticated (Author+) Path Traversal ↗
    2024-09-30 CVE-2024-47637 Improper Limitation of a Pathname to a Restricted Directory Affects <= 6.4.1 Patched in 6.5.1
17. Patched Medium · 6.4 LiteSpeed Cache <= 6.5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-09-30 CVE-2024-47373 Improper Neutralization of Input During Web Page Generation Affects <= 6.5.0.2 Patched in 6.5.1
18. Patched High · 7.2 LiteSpeed Cache <= 6.1 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-09-30 CVE-2024-47374 Improper Neutralization of Input During Web Page Generation Affects <= 6.5.0.2 Patched in 6.5.1
19. Patched Medium · 5.5 litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-09-24 CVE-2024-9169 Improper Neutralization of Input During Web Page Generation Affects <= 6.4.1 Patched in 6.5
20. Patched High · 7.5 LiteSpeed Cache <= 6.4.1 - Unauthenticated Sensitive Information Exposure via Log Files ↗
    2024-09-05 CVE-2024-44000 Insertion of Sensitive Information into Log File Affects <= 6.4.1 Patched in 6.5.0.1
21. Patched Critical · 9.8 LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation ↗
    2024-08-21 CVE-2024-28000 Improper Privilege Management Affects <= 6.3.0.1 Patched in 6.4
22. Patched Medium · 6.1 LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting ↗
    2024-07-23 CVE-2024-3246 Cross-Site Request Forgery Affects <= 6.2.0.1 Patched in 6.3
23. Patched Medium · 5.3 LiteSpeed Cache <= 5.7 - Missing Authorization via update_cdn_status ↗
    2024-02-27 CVE-2023-45000 Missing Authorization Affects <= 5.7 Patched in 5.7.0.1
24. Patched High · 7.2 LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg' ↗
    2024-02-27 CVE-2023-40000 Improper Neutralization of Input During Web Page Generation Affects <= 5.7 Patched in 5.7.0.1
25. Patched Medium · 6.4 LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-10-23 CVE-2023-4372 Improper Neutralization of Input During Web Page Generation Affects <= 5.6 Patched in 5.7
26. Patched Medium · 4.3 LiteSpeed Cache <= 5.3 - Missing Authorization to Toggle Crawler State ↗
    2023-03-22 CVE-2022-46800 Missing Authorization Affects <= 5.3 Patched in 5.3.1
27. Patched Medium · 6.1 LiteSpeed Cache <= 4.4.3 - Reflected Cross-Site Scripting via qc_res ↗
    2021-11-30 CVE-2021-24963 Improper Neutralization of Input During Web Page Generation Affects 1.0.15 - 4.4.3 Patched in 4.4.4
28. Patched Medium · 6.5 LiteSpeed Cache <= 4.4.3 - Authorization Bypass ↗
    2021-11-30 CVE-2021-24964 Improper Neutralization of Input During Web Page Generation Affects 1.0.15 - 4.4.3 Patched in 4.4.4
29. Patched Medium · 5.5 LiteSpeed Cache <= 3.6 - Authenticated Stored Cross-Site Scripting via IP setting ↗
    2020-12-26 CVE-2020-29172 Improper Neutralization of Input During Web Page Generation Affects <= 3.6 Patched in 3.6.1

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 46 languages, 21 at 90% or more

Plus 22 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-04-22 6M+ → 7M+ up after 235 days in tier
2. 2024-08-30 5M+ → 6M+ up after 266 days in tier
3. 2023-12-08 4M+ → 5M+ up after 297 days in tier
4. 2023-02-14 3M+ → 4M+ up after 378 days in tier
5. 2022-02-01 2M+ → 3M+ up after 245 days in tier
6. 2021-06-01 1M+ → 2M+ up after 385 days in tier
7. 2020-05-12 900K+ → 1M+ up after 29 days in tier
8. 2020-04-13 800K+ → 900K+ up after 148 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for LiteSpeed Cache into a readme, a review or a deck. It updates itself.

LiteSpeed Cache: 7M+ active installs, 4.8★ (2,778 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/litespeed-cache