CVE-2026-74932: WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache Poisoning

Q: Who is exposed after a successful attack?

Every subsequent visitor served a poisoned cached page may execute arbitrary JavaScript sourced from an attacker-controlled server. The impact includes compromise of confidentiality, integrity, and availability in visitors’ browser sessions.

Q: What does an attacker need to exploit this issue?

The attacker does not need authentication, but must be able to send a request with a chosen Host header and control a server referenced by the poisoned cached page. Exploitation also requires a cached page to be served to later visitors.

Q: Which installations require remediation?

WP Fastest Cache versions before 1.5.1 are affected. Updating to version 1.5.1 or later removes the vulnerable behavior described.

Published Aug 25, 2026

Updated

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.

Affected Software

2 affected components

WP Fastest Cache<=1.5.0

WP Fastest Cache>=0.9.0.3<=1.5.0

Event History

Aug 25, 2026

CVE Published

via MITRE·08:05 PM

Data Sourced

via MITRE·08:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed after a successful attack?

Every subsequent visitor served a poisoned cached page may execute arbitrary JavaScript sourced from an attacker-controlled server. The impact includes compromise of confidentiality, integrity, and availability in visitors’ browser sessions.

What does an attacker need to exploit this issue?

The attacker does not need authentication, but must be able to send a request with a chosen Host header and control a server referenced by the poisoned cached page. Exploitation also requires a cached page to be served to later visitors.

Which installations require remediation?

WP Fastest Cache versions before 1.5.1 are affected. Updating to version 1.5.1 or later removes the vulnerable behavior described.

CVE-2026-74932: WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache Poisoning

Affected Software

Event History

Frequently Asked Questions

Who is exposed after a successful attack?

What does an attacker need to exploit this issue?

Which installations require remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed after a successful attack?

What does an attacker need to exploit this issue?

Which installations require remediation?