7.5
High
CVE-2026-74932 The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs…
Description
The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP Fastest Cache 0.9 | 0.9.0.3 → < 1.5.1 | 1.5.1 |
Other CVEs of WP Fastest Cache
The 6 CVEs of WP Fastest Cache →
CVE-2026-74916
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its…
6.5
Medium
CVE-2021-24870
The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action,…
6.1
Medium
CVE-2021-24869
The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before…
8.8
High
CVE-2023-6063
The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it…
Not rated