CVE-2026-74932

HighCVSS 7.5

Published: 25/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 26/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

The WP Fastest Cache WordPress plugin before version 1.5.1 does not validate the Host header before using it to build URLs of asset files embedded in cached pages and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.

Risk Assessment

An attacker can inject malicious scripts into cached pages, potentially leading to user data theft, session hijacking, or malware distribution.

Recommendation

Update the WP Fastest Cache plugin to version 1.5.1 or later immediately and implement Host header validation on the server.

Other vulnerabilities in WP Fastest Cache

CVE-2026-19760High
The WP Fastest Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. This requires the Polylang or Polylang Pro plugin to be active and the Combine JS option enabled.

Original NVD description (English source)

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.