WordPress plugin · wp-fastest-cache
Is WP Fastest Cache safe?
Safe on 1.5.3 or newer.
The current version, 1.5.3, is past every affected range on record (30 of 30 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 30
- High or critical
- 10
- Exploited
- none
- Current version
- 1.5.3
- Last updated
- Oct 10, 2026
- Active installs
- 1,000,000+
Every recorded flaw
- Sep 1, 2026WP Fastest Cache: Does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with themCVE-2026-74916 · fixed in 1.5.1 · reported by WPScanMedium 6.5
- Aug 26, 2026WP Fastest Cache – WordPress Cache: Stored Cross-Site ScriptingCVE-2026-19760 · affects up to 1.5.0 · reported by WordfenceHigh 7.2
- Aug 25, 2026WP Fastest Cache: Does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it cachesCVE-2026-74932 · fixed in 1.5.1 · reported by WPScanHigh 7.5
- Nov 27, 2025WP Fastest Cache: Unauthorized modification of dataCVE-2025-10476 · affects up to 1.4.0 · reported by WordfenceMedium 4.3
- Oct 16, 2024WP Fastest Cache: Unauthorized arbitrary file deletionCVE-2020-36836 · affects up to 0.9.0.2 · reported by Wordfence1.5% oddsHigh 8
- May 23, 2024WP Fastest Cache: Directory TraversalCVE-2024-4347 · affects up to 1.2.6 · reported by WordfenceHigh 7.2
- Jan 16, 2024WP Fastest Cache: Is lacking a CSRF check in its wpfc_save_cdn_integration AJAX actionCVE-2021-24870 · fixed in 0.9.5 · reported by WPScanMedium 6.1
- Jan 16, 2024WP Fastest Cache: Does not escape user input in the set_urls_with_terms method before using it in a SQL statementCVE-2021-24869 · fixed in 0.9.5 · reported by WPScan1.2% oddsHigh 8.8
- Dec 4, 2023WP Fastest Cache: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-6063 · fixed in 1.2.2 · reported by WPScan74% oddsHigh 7.5
- Jun 9, 2023WP Fastest Cache: Unauthorized cache deletionCVE-2023-1375 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- May 30, 2023WP Fastest Cache: Does not have CSRF check in an AJAX actionCVE-2023-1938 · fixed in 1.1.5 · reported by WPScan8.5% oddsHigh 8.8
- Apr 6, 2023WP Fastest Cache: Unauthorized data lossCVE-2023-1931 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- Apr 6, 2023WP Fastest Cache: Unauthorized data deletionCVE-2023-1930 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- Apr 6, 2023WP Fastest Cache: Unauthorized data modificationCVE-2023-1929 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- Apr 6, 2023WP Fastest Cache: Unauthorized data modificationCVE-2023-1928 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1927 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1926 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1925 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1924 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1923 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1922 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1921 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1920 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1919 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- Apr 6, 2023WP Fastest Cache: Cross-Site Request ForgeryCVE-2023-1918 · affects up to 1.1.2 · reported by WordfenceMedium 4.3
- Apr 27, 2021WP Fastest Cache versions prior to 0.9.1.7: Directory traversalCVE-2021-20714 · fixed in 0.9.1.7 · reported by vultures@jpcert.or.jp2.6% oddsMedium 6.5
- Aug 14, 2019The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameterCVE-2015-9316 · fixed in 0.8.4.9 · reported by MITRE3.0% oddsCritical 9.8
- Jul 30, 2019The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal.CVE-2019-13635 · affects up to 0.8.9.5 · reported by MITRE44% oddsCritical 9.1
- Jul 29, 2019The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_foCVE-2019-6726 · affects up to 0.8.9.0 · reported by MITRE4.3% oddsMedium 6.5
- Sep 19, 2017Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPreCVE-2015-4089 · fixed in 0.8.3.5 · reported by MITREHigh 8.8
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.