CVE-2026-19760: WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header
The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Polylang or Polylang Pro plugin to be active and the Combine JS option to be enabled, as these conditions trigger the vulnerable Host-header-to-URL code path that writes attacker-controlled script src values into the shared page-cache file served to all subsequent visitors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/wp-fastest-cacheto a version that resolves this vulnerability.Fixed in 1.5.0 - Configuration
Disable the 'Combine JS' option to prevent the Host-header-to-URL code path that writes attacker-controlled script src values into the shared page-cache file.
WP Fastest Cache – WordPress Cache Plugin Combine JS = disabled - Configuration
Ensure either Polylang or Polylang Pro is not active, since the vulnerable Host-header-to-URL code path is triggered only when one of these plugins is active.
Polylang / Polylang Pro plugin active status = inactive
Event History
Frequently Asked Questions
What configuration is required for exploitation?
The affected plugin must be at version 1.5.0 or earlier, Polylang or Polylang Pro must be active, and the Combine JS option must be enabled. These conditions invoke the vulnerable code path that uses the HTTP Host header to construct a script source URL.
Does an attacker need an account or user interaction to inject the payload?
No. The vulnerability can be exploited by an unauthenticated attacker, and the attack complexity is low with no user interaction required for injection.
Who is exposed after a successful injection?
The malicious script is written into a shared page-cache file and can be served to subsequent visitors of the injected page. It executes when a user accesses that cached page.
What can be done if the plugin cannot be updated immediately?
Disable the Combine JS option or deactivate Polylang or Polylang Pro to prevent the specified vulnerable code path from being triggered.