CVE-2026-74932

highCVSS 7.5covered by 1 sourcefirst seen 2026-08-25

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.

⚡ Watch CVE-2026-74932

Get an email if CVE-2026-74932 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

highCVE-2026-74932: The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before us…nvd · 2026-08-25

External references

NVD record for CVE-2026-74932

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-74932 status](https://www.csirts.com/badge/CVE-2026-74932)](https://www.csirts.com/cve/CVE-2026-74932)