Stored Cross-Site Scripting Vulnerability in WP Fastest Cache Plugin for WordPress

CVE-2026-19760

What is CVE-2026-19760?

The WP Fastest Cache plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in all versions up to and including 1.5.0. This vulnerability enables unauthenticated attackers to inject malicious scripts into webpages. To exploit this issue, the Polylang or Polylang Pro plugin must be active and the Combine JS option enabled, which leads to the execution of attacker-controlled scripts whenever a user accesses a compromised page. The vulnerability's impact is significant as it affects all subsequent visitors to the cached pages.

References