CVE-2026-19760
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The WP Fastest Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. This requires the Polylang or Polylang Pro plugin to be active and the Combine JS option enabled.
Risk Assessment
An attacker can inject malicious scripts that execute in visitors' browsers, potentially leading to session theft, account takeover, or malware distribution.
Recommendation
Update WP Fastest Cache to the latest version and consider disabling the Combine JS option if not essential.
Other vulnerabilities in WP Fastest Cache
See all- CVE-2026-74916Medium
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
- CVE-2026-74932High
The WP Fastest Cache WordPress plugin before version 1.5.1 does not validate the Host header before using it to build URLs of asset files embedded in cached pages and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.
Original NVD description (English source)
The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Polylang or Polylang Pro plugin to be active and the Combine JS option to be enabled, as these conditions trigger the vulnerable Host-header-to-URL code path that writes attacker-controlled script src values into the shared page-cache file served to all subsequent visitors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS