CVE-2026-74932
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The WP Fastest Cache WordPress plugin before version 1.5.1 does not validate the Host header before using it to build URLs of asset files embedded in cached pages and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.
Risk Assessment
An attacker can inject malicious scripts into cached pages, potentially leading to user data theft, session hijacking, or malware distribution.
Recommendation
Update the WP Fastest Cache plugin to version 1.5.1 or later immediately and implement Host header validation on the server.
Other vulnerabilities in WP Fastest Cache
See all- CVE-2026-74916Medium
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
- CVE-2026-19760High
The WP Fastest Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. This requires the Polylang or Polylang Pro plugin to be active and the Combine JS option enabled.
Original NVD description (English source)
The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS