What is the CVSS score of CVE-2026-18109?

CVE-2026-18109 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of W3 Total Cache are affected by CVE-2026-18109?

W3 Total Cache, deployed on 2+ million WordPress sites globally, contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious code into website…

How to fix or mitigate CVE-2026-18109?

Within 24 hours, inventory all WordPress installations using W3 Total Cache version 2.10.3 or earlier, and identify which sites have both public commenting and Lazy Load Images features simultaneously enabled. Within 7 days, implement interim controls: disable the Lazy Load Images feature in plugin settings, enforce comment moderation requiring approval before display, and configure Web Application Firewall rules to block script tags in comment submissions. Within 30 days, continuously monitor W3 Total Cache vendor security advisories for a patched version; if no patch emerges, evaluate switching to alternative caching solutions or implement permanent compensating controls including restrictive Content Security Policy headers and automated comment content sanitization.

W3 Total Cache CVE-2026-18109

EUVD-2026-58570 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-14 Wordfence

GHSA-9qc5-qhm2-7hh3

WordPress XSS W3 Total Cache Wordpress Plugin Boldgrid

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

AC:H because exploitation requires the Lazy Load Images feature to be enabled, a deployment condition entirely beyond attacker control; S:C and C:L/I:L reflect stored XSS scope change into victim browsers with no server availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 03:44 vuln.today

CVE Published

Aug 14, 2026 - 02:25 nvd

HIGH 7.2

DescriptionCVE.org

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Lazy Load Images feature of W3 Total Cache is enabled, as the unsafe re-emission occurs exclusively within the LazyLoad mutator's img tag rewriting step.

AnalysisAI

Stored cross-site scripting in W3 Total Cache WordPress plugin (all versions through 2.10.3) allows unauthenticated attackers to inject and persistently execute arbitrary JavaScript in victim browsers by embedding malicious content in the Comment Author Name field. The payload is activated exclusively when the plugin's Lazy Load Images feature is enabled, as the unsafe output occurs within the LazyLoad mutator's img tag rewriting step. No public exploit code or CISA KEV listing is identified at time of analysis, but the network-accessible, unauthenticated attack vector with scope change represents meaningful risk for any WordPress site with both public commenting and lazy load simultaneously active.

Technical ContextAI

W3 Total Cache (CPE: cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:*:*:*) is a performance caching plugin for WordPress developed by BoldGrid. The vulnerable component is the UserExperience_LazyLoad_Mutator class, which post-processes HTML output to rewrite img tags for deferred loading. The Trac source references identify specific sinks at UserExperience_LazyLoad_Mutator.php lines 85, 162, and 403, as well as UserExperience_LazyLoad_Plugin.php line 116, where the Comment Author Name is re-emitted into rewritten img tag markup without invoking WordPress's standard escaping functions (e.g., esc_attr or esc_html). CWE-79 (Improper Neutralization of Input During Web Page Generation) precisely describes this root cause: user-supplied data accepted at one trust boundary - the comment submission form - is later re-emitted into an HTML attribute or content context without output encoding, creating a stored XSS sink that fires for every subsequent page visitor.

RemediationAI

Upgrade W3 Total Cache to version 2.10.4 or later; the patch is confirmed via the WordPress plugin Trac changeset at https://plugins.trac.wordpress.org/changeset/3635675/w3-total-cache/trunk/UserExperience_LazyLoad_Mutator.php, which corrects the unsafe re-emission in UserExperience_LazyLoad_Mutator.php. If immediate upgrade is not feasible, disabling the Lazy Load Images feature within the W3 Total Cache plugin settings eliminates the vulnerable code path entirely, at the trade-off of losing the page load performance benefit that lazy loading provides. A secondary workaround is to close or restrict WordPress comment sections on affected pages, removing the injection entry point - though this impacts site engagement. Sites using a WAF can deploy a rule blocking script content in comment author name fields as a partial, defense-in-depth measure. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/16ac73ae-6a0a-4c9b-8830-e0745061e587 provides supplemental detail.