Description

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Polylang or Polylang Pro plugin to be active and the Combine JS option to be enabled, as these conditions trigger the vulnerable Host-header-to-URL code path that writes attacker-controlled script src values into the shared page-cache file served to all subsequent visitors.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-26T06:16:26.007Z",
  "pubdate": "2026-08-26T06:16:26.007Z",
  "executiveSummary": "The WP Fastest Cache plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability originating from improper validation of the HTTP Host header.\nThis flaw allows unauthenticated remote attackers to inject malicious JavaScript payloads into the plugin's cached files.\nThe vulnerability affects all versions up to and including 1.5.0, provided that the Polylang or Polylang Pro plugin is active and the 'Combine JS' optimization feature is enabled.\nSuccessful exploitation results in the execution of arbitrary scripts within the context of the victim's browser session whenever they visit the affected cached page.\nThis facilitates unauthorized actions, session hijacking, and potential exfiltration of sensitive user data.\nBecause the payload is persisted in the shared cache file, the attack does not require interaction with the attacker after the initial injection, and it affects all subsequent visitors to the compromised cached pages, significantly increasing the risk profile for administrators and users alike.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of the HTTP Host header during the generation of cached JavaScript files. Specifically, when the WP Fastest Cache plugin processes JS files under the 'Combine JS' feature, it incorrectly incorporates the value of the HTTP Host header into the URLs generated for these combined files.\nBecause the HTTP Host header is user-controllable and inadequately sanitized, an attacker can supply a malicious string containing JavaScript payload segments. When the plugin encounters the specific conditions involving the Polylang or Polylang Pro integration, it fails to perform appropriate output escaping or URL validation before writing these values to the persistent cache directory.\nThe attack flow proceeds as follows: First, an unauthenticated attacker sends an HTTP request to the target WordPress instance with a crafted Host header containing the XSS payload. Second, if the Polylang plugin is active and 'Combine JS' is enabled, the plugin triggers its file combination logic. Third, the plugin mistakenly uses the manipulated Host header to construct the 'src' attribute for the combined JS file references. Fourth, these references are written into the static HTML cache file generated by the plugin.\nConsequently, the malicious script is persisted on the server's disk as part of the public-facing cached page. When subsequent users, including authenticated administrators, load the compromised page, the browser parses the injected script src or embedded payload, leading to arbitrary JavaScript execution in the victim's security context.\nThis vulnerability is particularly severe because the payload is served directly from the cache to all visitors without requiring further authentication or specific privileges from the attacker. The persistence of the payload within the shared cache ensures that the malicious script is executed universally until the cache is cleared or the file is overwritten. The exploitation does not require the attacker to maintain a presence or interact with the server after the injection is successful, effectively turning the server into a distribution vector for the XSS attack."
}