WP Fastest Cache CVE-2026-19760

Three specific conditions must all be simultaneously true for this vulnerability to be exploitable: (1) WP Fastest Cache version 1.5.0 or earlier must be installed and active on the WordPress site; (2) the Polylang or Polylang Pro multilingual plugin must be installed and active - this is the prerequisite that triggers the Host-header-to-URL code path within the JS combination logic; (3) the 'Combine JS' option must be explicitly enabled in WP Fastest Cache settings - this is a non-default feature that must be deliberately activated by the site administrator. Sites lacking Polylang or Polylang Pro, or with Combine JS disabled, are not exposed through this code path even if running a vulnerable plugin version. The attacker requires no authentication (PR:N from CVSS vector) but has no control over whether target sites have both prerequisite conditions enabled.

The CVSS 7.2 score and Scope:Changed metric (S:C) appropriately reflect the stored, persistent nature of this XSS - a single malicious request can poison a cache file subsequently read by all site visitors, amplifying impact well beyond a typical reflected XSS. However, the provided CVSS vector metric AC:L does not account for the two configuration prerequisites - Polylang or Polylang Pro must be active and Combine JS must be explicitly enabled - both of which are outside the attacker's control and together reduce the exploitable population to a subset of WP Fastest Cache deployments. Multilingual WordPress sites running this specific plugin combination carry meaningful risk, as the stored XSS silently persists across cached pages until the cache is purged. No EPSS score was provided in the source intelligence, and KEV status is not confirmed, meaning real-world exploitation probability is inferred rather than confirmed. No public exploit code was referenced. The C:L and I:L impacts are consistent with typical XSS outcomes - session token theft, credential harvesting, and page content manipulation - without availability impact. Overall, this is a real but configuration-gated risk: high-severity for affected deployments, lower priority for sites not running Polylang with Combine JS enabled.

An attacker discovers a WordPress site running WP Fastest Cache 1.5.0 or earlier with both Polylang active and Combine JS enabled, then sends a crafted HTTP request with a Host header value containing a reference to an attacker-controlled script URL. The plugin's js-utilities.php code writes this value into the shared combined-JS cache file on disk without sanitization. All subsequent site visitors who receive the poisoned cached response automatically load the attacker's script, enabling session cookie theft, credential harvesting, or arbitrary actions on behalf of authenticated users including administrators. The vulnerable code path is publicly visible in the plugin's Trac repository, lowering the bar for exploit development even without a published proof-of-concept.