CVE-2026-19760: WP Fastest Cache Plugin XSS Vulnerability

CVE-2026-19760 Overview

CVE-2026-19760 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Fastest Cache WordPress plugin. The flaw affects all versions up to and including 1.5.0. The plugin fails to sanitize the HTTP Host header before writing it into cached pages, allowing unauthenticated attackers to inject arbitrary web scripts. Exploitation requires the Polylang or Polylang Pro plugin to be active and the Combine JS option to be enabled. When these conditions are met, attacker-controlled script src values persist in the shared page-cache file and execute for every subsequent visitor. The weakness is classified under [CWE-79].

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in the browser of every visitor to affected cached pages.

Affected Products

WP Fastest Cache – WordPress Cache Plugin versions up to and including 1.5.0
WordPress sites running Polylang or Polylang Pro alongside WP Fastest Cache
WordPress installations with the Combine JS option enabled in WP Fastest Cache

Discovery Timeline

2026-08-26 - CVE-2026-19760 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-19760

Vulnerability Analysis

The vulnerability resides in the JavaScript combination logic of WP Fastest Cache. When the Combine JS option is enabled and Polylang or Polylang Pro is active, the plugin constructs URLs for combined script assets using the raw HTTP Host header supplied by the client. The plugin does not sanitize this input or escape the resulting value before writing it into the cached HTML output.

Because the output is stored in a shared page-cache file, a single crafted request poisons the cache for all subsequent visitors. The injected payload executes in the browser context of every user requesting the affected page until the cache is regenerated. This qualifies as Stored XSS rather than reflected XSS, since the malicious script persists on the server-side cache.

The attack requires no authentication and no user interaction beyond visiting the poisoned page.

Root Cause

The root cause is insufficient input validation and output escaping on the Host header value. Source code inspection of inc/js-utilities.php and wpFastestCache.php shows that the header is consumed directly when building script source URLs. Combined with the trust placed in a client-controlled header, this produces a classic [CWE-79] Improper Neutralization of Input During Web Page Generation flaw.

Attack Vector

An attacker sends an HTTP request to the target WordPress site with a crafted Host header containing script-injection payloads. The vulnerable code path writes the manipulated value into the combined JS src attribute in the cached page. Subsequent visitors receive the poisoned cache entry and their browsers execute the attacker-supplied JavaScript. See the Wordfence Vulnerability Report and the WP Fastest Cache source at js-utilities.php line 257 for the vulnerable code path.

Detection Methods for CVE-2026-19760

Indicators of Compromise

Cached HTML files under the WP Fastest Cache directory containing <script> tags with unexpected src values or unusual hostnames.
Web server access logs showing requests with anomalous Host header values that do not match configured site domains.
Unexpected outbound requests from visitor browsers to attacker-controlled domains referenced in cached pages.

Detection Strategies

Inspect the on-disk page cache for combined JavaScript references that do not resolve to the site's canonical hostname.
Review reverse-proxy or WAF logs for requests where the Host header contains characters such as ", <, >, or / that are illegal in valid hostnames.
Correlate cache regeneration timestamps with suspicious inbound requests to identify likely cache-poisoning events.

Monitoring Recommendations

Enable logging of the raw Host header at the web server or WAF tier and alert on deviations from an allowlist of expected domains.
Monitor the WP Fastest Cache output directory for file changes and flag additions containing script tags with external hostnames.
Track Content Security Policy (CSP) violation reports from end-user browsers to surface injected script execution.

How to Mitigate CVE-2026-19760

Immediate Actions Required

Upgrade WP Fastest Cache to a version later than 1.5.0 that addresses the Host-header sanitization issue.
Purge the existing WP Fastest Cache page cache to remove any poisoned entries after upgrading.
Audit the site for the combination of WP Fastest Cache, Polylang or Polylang Pro, and the Combine JS setting, as these define the vulnerable configuration.

Patch Information

Refer to the Wordfence Vulnerability Report for the fixed version details. Update the plugin through the WordPress admin plugin manager or via WP-CLI once the vendor patch is applied.

Workarounds

Disable the Combine JS option in the WP Fastest Cache settings to close the vulnerable code path.
Deactivate Polylang or Polylang Pro if it is not required, since the flaw only triggers when Polylang is active.
Configure the web server or reverse proxy to reject requests whose Host header does not match an allowlist of canonical site domains.

bash

# nginx example: enforce Host header allowlist before requests reach PHP
server {
    listen 443 ssl;
    server_name example.com www.example.com;

    if ($host !~* ^(example\.com|www\.example\.com)$) {
        return 444;
    }

    # remaining WordPress configuration
}