# WP Fastest Cache – WordPress Cache Plugin

> The simplest and fastest WP Cache system

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-06 04:22 UTC.

## Facts (WordPress.org)

- Slug: `wp-fastest-cache`
- Author: Emre Vona
- Version: 1.5.5
- Active installs: 1+ million
- Last update: 2026-11-05 (1 day ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.7, PHP any
- Tags: cache, core web vitals, Optimize, pagespeed, performance
- Page: https://wordpress.org/plugins/wp-fastest-cache/

## Checks (against WordPress 7.1.4)

- OK: Updated 1 day ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Slows pages ↔ Speeds up, Clashes ↔ Plays well, Flaky ↔ Reliable, Breaking ↔ Smooth, Behind ↔ Current, Heavy ↔ Light.

## Known vulnerabilities

- 2026-11-03 MEDIUM: Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response (up to 1.5.3). CVE-2026-111464, https://www.wordfence.com/threat-intel/vulnerabilities/id/83539a88-b90e-49f0-a599-b3f83b2d97b9?source=api-prod
- 2026-09-01 MEDIUM: Unauthenticated Cache Poisoning (0.8.7.7 to 1.5.0). CVE-2026-74916, https://www.wordfence.com/threat-intel/vulnerabilities/id/dd203abf-689e-44d3-9194-dba60f1ca4b2?source=api-prod
- 2026-08-26 HIGH: Unauthenticated Stored Cross-Site Scripting via HTTP Host Header (up to 1.5.0). CVE-2026-19760, https://www.wordfence.com/threat-intel/vulnerabilities/id/69a22238-88e8-4ff5-8e2b-8c58a04ff154?source=api-prod
- 2026-08-25 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 1.5.0). CVE-2026-74932, https://www.wordfence.com/threat-intel/vulnerabilities/id/40e4a3d7-36db-4420-a854-6499afa9a9a1?source=api-prod
- 2025-11-26 MEDIUM: Missing Authorization to Authenticated (Subscriber+) DB Cleanup Actions (up to 1.4.0). CVE-2025-10476, https://www.wordfence.com/threat-intel/vulnerabilities/id/c24cf4de-1392-43a8-85a5-8c66c00c44d7?source=api-prod
- 2024-05-10 HIGH: Authenticated (Administrator+) Arbitrary File Deletion (up to 1.2.6). CVE-2024-4347, https://www.wordfence.com/threat-intel/vulnerabilities/id/634d4062-7004-4e89-89a8-323c939aae93?source=api-prod
- 2023-11-13 CRITICAL: Unauthenticated SQL Injection (up to 1.2.1). CVE-2023-6063, https://www.wordfence.com/threat-intel/vulnerabilities/id/876efd71-8867-44b8-8017-86fad2a1b89f?source=api-prod
- 2023-05-02 MEDIUM: Authenticated(Administrator+) Blind Server Side Request Forgery via check_url (up to 1.1.4). CVE-2023-1938, https://www.wordfence.com/threat-intel/vulnerabilities/id/b937940c-a3e0-49d3-b066-550b78351b54?source=api-prod
- 2023-04-06 MEDIUM: Cross-Site Request Forgery via 'wpfc_preload_single_save_settings_callback' (up to 1.1.2). CVE-2023-1919, https://www.wordfence.com/threat-intel/vulnerabilities/id/024f4058-065b-48b4-a08a-d9732d4375cd?source=api-prod
- 2023-04-06 MEDIUM: Cross-Site Request Forgery via 'wpfc_clear_cache_of_allsites_callback' (up to 1.1.2). CVE-2023-1925, https://www.wordfence.com/threat-intel/vulnerabilities/id/096257a4-6ee9-41e1-8a59-4ffcd309f83c?source=api-prod
- 2023-04-06 MEDIUM: Cross-Site Request Forgery via 'wpfc_start_cdn_integration_ajax_request_callback' (up to 1.1.2). CVE-2023-1921, https://www.wordfence.com/threat-intel/vulnerabilities/id/17c7c61d-c110-448e-ad8a-bc1c00393524?source=api-prod
- 2023-04-06 MEDIUM: Cross-Site Request Forgery via 'wpfc_preload_single_callback' (up to 1.1.2). CVE-2023-1918, https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8034ff-cf36-498f-9efc-a4e6bbb92b2c?source=api-prod
- 2023-04-06 MEDIUM: Missing Authorization in 'wpfc_purgecache_varnish_callback' (up to 1.1.2). CVE-2023-1929, https://www.wordfence.com/threat-intel/vulnerabilities/id/1e567aec-07e5-494a-936d-93b40d3e3043?source=api-prod
- 2023-04-06 MEDIUM: Cross-Site Request Forgery via 'wpfc_remove_cdn_integration_ajax_request_callback' (up to 1.1.2). CVE-2023-1923, https://www.wordfence.com/threat-intel/vulnerabilities/id/49ba5cfa-c2cc-49ac-b22d-7e36ccca6ac5?source=api-prod
- 2023-04-06 MEDIUM: Cross-Site Request Forgery via 'deleteCssAndJsCacheToolbar' (up to 1.1.2). CVE-2023-1927, https://www.wordfence.com/threat-intel/vulnerabilities/id/4d3858f5-3f13-400c-acf4-eb3dc3a43308?source=api-prod
- 2023-04-06 MEDIUM: Missing Authorization in 'wpfc_preload_single_callback' (up to 1.1.2). CVE-2023-1928, https://www.wordfence.com/threat-intel/vulnerabilities/id/56a90042-a6c0-4487-811b-ced23c97f9f4?source=api-prod
- 2023-04-06 MEDIUM: Cross-Site Request Forgery via 'wpfc_pause_cdn_integration_ajax_request_callback' (up to 1.1.2). CVE-2023-1922, https://www.wordfence.com/threat-intel/vulnerabilities/id/a1743b26-861e-4a61-80de-b8cc82308228?source=api-prod
- 2023-04-06 MEDIUM: Cross-Site Request Forgery via 'wpfc_toolbar_save_settings_callback' (up to 1.1.2). CVE-2023-1924, https://www.wordfence.com/threat-intel/vulnerabilities/id/a87f610a-c1ef-4365-bd74-569989587d41?source=api-prod
- 2023-04-06 MEDIUM: Missing Authorization to Cache Deletion (up to 1.1.2). CVE-2023-1375, https://www.wordfence.com/threat-intel/vulnerabilities/id/ae643666-70cb-4eb4-a183-e1649264ded4?source=api-prod
- 2023-04-06 MEDIUM: Missing Authorization in 'deleteCssAndJsCacheToolbar' (up to 1.1.2). CVE-2023-1931, https://www.wordfence.com/threat-intel/vulnerabilities/id/b4bb2d72-ff31-4220-acb3-ed17bb9229b5?source=api-prod
- 2023-04-06 MEDIUM: Cross-Site Request Forgery via 'deleteCacheToolbar' (up to 1.1.2). CVE-2023-1926, https://www.wordfence.com/threat-intel/vulnerabilities/id/b793a4cb-3130-428e-9b61-8ce29fcdaf70?source=api-prod
- 2023-04-06 MEDIUM: Missing Authorization in 'wpfc_clear_cache_of_allsites_callback' (up to 1.1.2). CVE-2023-1930, https://www.wordfence.com/threat-intel/vulnerabilities/id/bae67a68-4bd1-4b52-b3dd-af0eef014028?source=api-prod
- 2023-04-06 MEDIUM: Cross-Site Request Forgery via 'wpfc_purgecache_varnish_callback' (up to 1.1.2). CVE-2023-1920, https://www.wordfence.com/threat-intel/vulnerabilities/id/c8e90994-3b5c-4ae6-a27f-890a9101b440?source=api-prod
- 2022-01-24 MEDIUM: Directory Traversal to Arbitrary File Deletion (up to 0.8.9.0). CVE-2019-6726, https://www.wordfence.com/threat-intel/vulnerabilities/id/6d1ad409-d5d3-4231-9a7c-de881c7b9de2?source=api-prod
- 2021-10-14 HIGH: Cross-Site Request Forgery to Stored Cross-Site Scripting (before 0.9.5). CVE-2021-24870, https://www.wordfence.com/threat-intel/vulnerabilities/id/372a4550-c38e-46d6-b7f2-15e05708d128?source=api-prod
- 2021-10-14 HIGH: Authenticated (Subscriber+) SQL Injection (before 0.9.5). CVE-2021-24869, https://www.wordfence.com/threat-intel/vulnerabilities/id/859fe629-701e-4d47-8e90-59860f7c6b82?source=api-prod
- 2021-04-27 MEDIUM: Authenticated (Admin+) Directory Traversal to Arbitrary File Deletion (before 0.9.1.7). CVE-2021-20714, https://www.wordfence.com/threat-intel/vulnerabilities/id/20989781-def0-4ffd-bf24-40ed34b3e922?source=api-prod
- 2020-02-05 HIGH: Authenticated (Subscriber+) Arbitrary File Deletion (before 0.9.0.3). CVE-2020-36836, https://www.wordfence.com/threat-intel/vulnerabilities/id/82f80916-37ab-4c5a-9787-2544c620acac?source=api-prod
- 2019-07-28 CRITICAL: Directory Traversal (up to 0.8.9.5). CVE-2019-13635, https://www.wordfence.com/threat-intel/vulnerabilities/id/07fc1249-a50d-4038-8cbe-35ff7a3d28b3?source=api-prod
- 2018-10-09 HIGH: Cross-Site Request Forgery via page to wpfastestcacheoptions (up to 0.8.8.5). CVE-2018-17584, https://www.wordfence.com/threat-intel/vulnerabilities/id/5965a8b6-116e-4029-9a76-b64c03c25ece?source=api-prod
- 2018-10-09 MEDIUM: Cross-Site Scripting via rules[0][content] parameter (up to 0.8.8.5). CVE-2018-17586, https://www.wordfence.com/threat-intel/vulnerabilities/id/9dac1d91-b9a9-47e0-86cb-2000659196c5?source=api-prod
- 2018-10-09 MEDIUM: Cross-Site Scripting via wpFastestCachePage options, wpFastestCachePreload_number or wpFastestCacheLanguage parameter (up to 0.8.8.5). CVE-2018-17585, https://www.wordfence.com/threat-intel/vulnerabilities/id/a8ca195d-312b-41d2-a9d7-4d306fc800ce?source=api-prod
- 2018-10-09 MEDIUM: Cross-Site Scripting via the rules[0][content] parameter in a wpfc_save_exclude_pages action (up to 0.8.8.5). CVE-2018-17583, https://www.wordfence.com/threat-intel/vulnerabilities/id/ef6538e7-8cde-4c49-9965-0624a25ffe65?source=api-prod
- 2018-02-22 HIGH: SQL Injection (up to 0.8.7.4). WF-65b3baaf-86e4-4dd2-b3eb-84c21eabdd6d, https://www.wordfence.com/threat-intel/vulnerabilities/id/65b3baaf-86e4-4dd2-b3eb-84c21eabdd6d?source=api-prod
- 2016-07-13 HIGH: Local File Inclusion (up to 0.8.5.9). WF-e8fe4aa7-13e6-48ec-afec-2888edd999f5, https://www.wordfence.com/threat-intel/vulnerabilities/id/e8fe4aa7-13e6-48ec-afec-2888edd999f5?source=api-prod
- 2016-05-24 HIGH: Local File Inclusion (up to 0.8.5.7). WF-3ebe25a7-fa4d-4e3f-b969-2ff3a8388b06, https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebe25a7-fa4d-4e3f-b969-2ff3a8388b06?source=api-prod
- 2016-05-23 MEDIUM: Missing Authorization (up to 0.8.5.7). WF-fcbd718b-4d7d-48a4-9db2-dd938de7c7eb, https://www.wordfence.com/threat-intel/vulnerabilities/id/fcbd718b-4d7d-48a4-9db2-dd938de7c7eb?source=api-prod
- 2015-11-11 CRITICAL: SQL Injection (before 0.8.4.9). CVE-2015-9316, https://www.wordfence.com/threat-intel/vulnerabilities/id/c23c3b24-893f-4589-8fab-bd54259bd105?source=api-prod
- 2015-05-26 HIGH: Multiple Cross-Site Request Forgery (before 0.8.3.5). CVE-2015-4089, https://www.wordfence.com/threat-intel/vulnerabilities/id/df32e1d0-3645-432c-a2e4-2d63709c4ffd?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=wp-fastest-cache · HTML: https://todaywp.com/plugins/wp-fastest-cache