The WP Fastest Cache plugin, for releases before 1.5.1, fails to validate the HTTP Host header before using it to construct URLs for cached asset files. An unauthenticated attacker can supply a malicious Host value, causing the plugin to embed references to an attacker‑controlled server in the cached page. When any visitor subsequently loads the affected page, the malicious payload is executed in the visitor’s browser, allowing the attacker to run arbitrary JavaScript, steal session data, or perform other actions within the victim’s browsing context. The weakness is a classic stored cross‑site scripting flaw in which injected data is persisted across user sessions.

WordPress websites that have the WP Fastest Cache plugin installed at any version earlier than 1.5.1 are affected. The issue exists regardless of the WordPress core version and does not rely on user‑specific settings—any user visiting a cached page can be impacted.

With a CVSS score of 7.5, the vulnerability is considered high severity. The EPSS score is < 1%, indicating a low probability of exploitation, but the flaw is exploitable without authentication and does not require privileged access. It is not listed in the CISA KEV catalog, yet the attack vector—HTTP Host header manipulation—is a common and easily achievable technique. An attacker who can send arbitrary Host header values to the target site can effectively poison the cache and force all subsequent page views to load attacker‑controlled scripts.