The vulnerability allows an attacker to store malicious JavaScript in the page‑cache file of a WordPress site by exploiting inadequate input sanitization and output escaping of the HTTP Host header. Because the stored payload is served to every visitor to the affected page, any user who loads the page can have the script executed in their browser. This enables credential theft, session hijacking, or other further attacks performed within the victim’s context. The weakness is a classic Stored Cross‑Site Scripting flaw (CWE‑79).

WordPress sites that use the WP Fastest Cache – WordPress Cache Plugin in versions up to and including 1.5.0, with the Polylang or Polylang Pro plugin active and the Combine JS option turned on. Those configurations activate the vulnerable code path that writes the attacker‑controlled script source into the shared cache file.

The CVSS score of 7.2 indicates a high severity level. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the presence of a stored XSS makes it attractive to attackers seeking to compromise site visitors. The attack requires an unauthenticated user to send a request with a manipulated Host header; the vulnerability is exploitable over the public internet, making it remotely executable and potentially impacting multiple users with a single injection.