WP Fastest Cache permits unauthenticated cache poisoning and cross-site scripting
WP Fastest Cache before 1.5.1 uses the unvalidated Host header to construct embedded asset URLs and omits that header from its cache key. An unauthenticated attacker can therefore cause a cached page to reference JavaScript on an attacker-controlled server; subsequent visitors receive the poisoned page and execute that script in the site's origin.
- Component
- WP Fastest Cache
- Plugin slug
wp-fastest-cache- Affected
- 0.9.0.3 to < 1.5.1
- Safe version
1.5.1- Published
- Aug 25, 2026
This CVE was published Aug 25, 2026 and is one of 34 known issues for this plugin.
Update, patch or deactivate.
Update to 1.5.1 or later, purge all page and asset caches after updating, and invalidate privileged sessions if administrators visited poisoned pages.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H