CVE-2021-47855
Published: 21 January 2026
Summary
CVE-2021-47855 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Openlitespeed (inferred from references). Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2021-47855 is a stored cross-site scripting (XSS) vulnerability (CWE-79) affecting OpenLiteSpeed version 1.7.9. The issue resides in the dashboard's Notes parameter, where malicious scripts can be injected. Specifically, attackers can craft a payload in the Notes field during listener configuration, which is stored and later executes when an administrator clicks on the Default Icon.
The vulnerability has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating network accessibility with low attack complexity and no privileges required. An unauthenticated attacker (PR:N) can exploit it by injecting the payload, leading to script execution in the context of the administrator's browser upon interaction with the Default Icon. This enables potential theft of session cookies, administrative actions, or further compromise within the scoped changed environment.
Advisories and resources are available from VulnCheck (https://www.vulncheck.com/advisories/openlitespeed-notes-stored-cross-site-scripting) and the vendor site (https://openlitespeed.org/), with a proof-of-concept exploit published on Exploit-DB (https://www.exploit-db.com/exploits/49727). No specific patch details are detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3632
Vulnerability details
Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripts. Attackers can craft a payload in the Notes field during listener configuration that will execute when an administrator clicks on…
more
the Default Icon.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing web dashboard directly enables exploitation of the application (T1190) and arbitrary JavaScript execution in admin browser context (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation of the Notes input field to reject or sanitize script payloads before they are stored during listener configuration.
Filters untrusted content on output so that stored script payloads cannot execute when the Default Icon is rendered in an administrator browser.
Monitors web-application inputs and stored dashboard data for anomalous script patterns that indicate attempted or successful XSS injection.