CVE-2026-19760: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in emrevona WP Fastest Cache – WordPress Cache Plugin

CVE-2026-19760 is a stored cross-site scripting vulnerability in the WP Fastest Cache – WordPress Cache Plugin. The flaw is due to insufficient input sanitization and output escaping of the HTTP Host Header in all versions up to and including 1.5.0. The vulnerability is triggered only when the Polylang or Polylang Pro plugin is active and the Combine JS option is enabled, which causes the vulnerable Host-header-to-URL code path to write attacker-controlled script source values into the shared page-cache file. This cached file is then served to all subsequent visitors, enabling persistent script execution in their browsers.

An unauthenticated attacker can inject arbitrary web scripts that execute in the browsers of users visiting the affected site, potentially leading to information disclosure or user session compromise. The vulnerability affects confidentiality and integrity but does not impact availability. Exploitation requires specific plugin configurations (Polylang or Polylang Pro active and Combine JS enabled).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Combine JS option or the Polylang/Polylang Pro plugins to mitigate the risk. Monitor vendor channels for updates and apply patches promptly once released.