WP Fastest Cache Unauthenticated Stored XSS via Host Header Cache Poisoning

Vulnerability Overview Vulnerability Name: WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache Poisoning Description: The plugin fails to validate the header when constructing the URL for cached pages. This allows unauthenticated attackers to poison cached pages via headers in the cache key, enabling server-controlled execution of arbitrary JavaScript. Impact: Cached pages containing the administrator username are only rebuilt during user registration or profile updates. Consequently, users who have been escalated to the administrator role will receive the poisoned page and execute the injected script within their authenticated administrator session. Affected Scope Affected Plugin: wp-fastest-cache Fixed Version: 1.5.1 Remediation Fixed Version: Upgrade to version 1.5.1 Additional Information CVE: CVE-2026-74932 Classification: - Type: XSS - OWASP Top 10: A7: Cross-Site Scripting (XSS) - CWE: CWE-79 - CVSS: 7.5 (High) Original Researcher: Jakub Herman Submitter: Jakub Herman Submitter Website: https://jakubherman.net Verified: Yes WPVDB ID: f1eebb4a-cfd1-419e-852d-e5a949437afb Timeline Public Disclosure Date: 2026-08-25 Added Date: 2026-08-25 Last Updated: 2026-08-25 Other Related Vulnerabilities Admin Options Pages < 0.9.8 - Reflected Cross-Site Scripting ADIF Log Search Widget <= 1.0f - Reflected Cross-Site Scripting My Tickets < 2.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting Simple Download Monitor < 3.9.11 - Contributor+ Stored Cross-Site Scripting via Shortcodes DsgnWrks Twitter Importer <= 1.1.4 - Reflected Cross-Site Scripting POC Code POC Code: The page states that the POC will be disclosed on 2026-09-26 to allow users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

WP Fastest Cache Unauthenticated Stored XSS via Host Header Cache Poisoning

More from this source