CVE-2026-19760

Name of the Vulnerable Software and Affected Versions WP Fastest Cache – WordPress Cache Plugin versions prior to 1.5.1

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via the HTTP Host Header. This occurs when the Polylang or Polylang Pro plugin is active and the Combine JS option is enabled, triggering a code path that writes attacker-controlled script src values into the shared page-cache file. Consequently, arbitrary web scripts execute whenever a user accesses an affected page.

Recommendations Update the plugin to a version later than 1.5.0. Disable the Combine JS option as a temporary mitigation measure.