Wp Fastest Cache Wordpress Cache Plugin
Monthly
Stored Cross-Site Scripting in WP Fastest Cache (WordPress plugin, all versions through 1.5.0) allows unauthenticated remote attackers to inject persistent JavaScript by supplying a crafted HTTP Host header that the plugin writes into shared page-cache files, which are then served to all subsequent visitors. Exploitation requires two co-present non-default conditions: the Polylang or Polylang Pro multilingual plugin must be installed and active, and the 'Combine JS' option must be enabled in WP Fastest Cache settings, both of which activate the vulnerable Host-header-to-URL code path in js-utilities.php. No public exploit code or CISA KEV listing has been identified at time of analysis.
WP Fastest Cache, a WordPress caching plugin, writes the full response of Core's wp-activate.php to a publicly readable cache file in versions up to and including 1.5.3, ignoring that endpoint's no-store/no-cache headers, its wp-activate-* cookie, and the WP_INSTALLING state. Because WordPress prints the new account's plaintext username and twelve-character password on that activation screen, unauthenticated attackers who can request the cached file can read the credentials of the most recently activated Multisite registrant. The exposure is heavily gated: the site must be a Multisite subdirectory installation with both public user and site registration enabled, and a real registrant must have just followed their activation link; the vulnerability is not known to be actively exploited (no CISA KEV entry) and no public exploit code was identified at time of analysis.
Stored Cross-Site Scripting in WP Fastest Cache (WordPress plugin, all versions through 1.5.0) allows unauthenticated remote attackers to inject persistent JavaScript by supplying a crafted HTTP Host header that the plugin writes into shared page-cache files, which are then served to all subsequent visitors. Exploitation requires two co-present non-default conditions: the Polylang or Polylang Pro multilingual plugin must be installed and active, and the 'Combine JS' option must be enabled in WP Fastest Cache settings, both of which activate the vulnerable Host-header-to-URL code path in js-utilities.php. No public exploit code or CISA KEV listing has been identified at time of analysis.
WP Fastest Cache, a WordPress caching plugin, writes the full response of Core's wp-activate.php to a publicly readable cache file in versions up to and including 1.5.3, ignoring that endpoint's no-store/no-cache headers, its wp-activate-* cookie, and the WP_INSTALLING state. Because WordPress prints the new account's plaintext username and twelve-character password on that activation screen, unauthenticated attackers who can request the cached file can read the credentials of the most recently activated Multisite registrant. The exposure is heavily gated: the site must be a Multisite subdirectory installation with both public user and site registration enabled, and a real registrant must have just followed their activation link; the vulnerability is not known to be actively exploited (no CISA KEV entry) and no public exploit code was identified at time of analysis.