CVE-2021-24870: medium-severity vulnerability in WP Fastest Cache
WP Fastest Cache < 0.9.5 - CSRF to Stored Cross-Site Scripting
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.3%
The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action, and does not sanitise and escape some the options available via the action, which could allow attackers to make logged in high privilege users call it and set a Cross-Site Scripting payload
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Unknown · WP Fastest CacheRelated CVEs — WP Fastest Cache
In the same product, most dangerous first.
CVE-2023-6063—WP Fastest Cache < 1.2.2 - Unauthenticated SQL InjectionEPSS 73.7%CVE-2023-1938HIGHWP Fatest Cache < 1.1.5 - Blind SSRF via CSRFEPSS 8.5%CVE-2021-24869HIGHWP Fastest Cache < 0.9.5 - Subscriber+ SQL InjectionEPSS 1.2%CVE-2026-74932HIGHWP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache PoisoningEPSS 0.4%CVE-2026-74916MEDIUMWP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking ParametersEPSS 0.2%