W3 Total Cache EUVD-2026-109252

The available description states only that W3 Total Cache (through 2.10.7) 'allows Stored XSS' and does not name the specific input field, parameter, setting, or deployment mode that is vulnerable - the trigger is not described in the available sources. Structurally, stored XSS requires two conditions: (1) the attacker must be able to write a payload into a field that W3 Total Cache persists and later renders, and (2) a victim must subsequently view the page where that payload is output (reflected in the vector as UI:R). The scope-change flag (S:C) indicates execution in the victim's browser security context. The supplied vector lists PR:N (unauthenticated), but the description does not confirm an unauthenticated injection point; because stored XSS in a plugin configuration surface commonly requires authenticated access, the practical limiting factor - required privilege to store the payload - cannot be verified from the available data. Required user interaction (a privileged user loading the affected page) is a confirmed limiting factor.

This is a genuine but mid-tier priority rather than an emergency. The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) describes a network-reachable, low-complexity stored XSS whose scope-change flag reflects script execution in a victim's browser authority. The vuln.today decision label is 'this_week', consistent with a serious-but-not-active-exploitation issue. Several high-urgency signals are ABSENT from the input: there is no EPSS probability supplied, no CISA KEV listing, and no verified exploit code - so exploitation status is 'no public exploit identified at time of analysis' (the sole reference is a Patchstack vulnerability-database entry, which is an advisory, not working exploit code). One signal to treat with caution: the supplied vector states PR:N (unauthenticated), yet stored XSS in a caching-plugin almost always requires the ability to persist a payload into a stored field, which typically implies some authenticated access - the available description does not state the injection point or privilege required, so the PR:N value cannot be independently confirmed. The S:C/UI:R combination also means a victim (likely an administrator viewing an affected page) must load the stored payload, which limits unattended mass exploitation. Net: patch within the vendor's/decision-label window, but this is not a drop-everything KEV-grade incident on current evidence.

An attacker persists a malicious script into a W3 Total Cache input that is later rendered back without proper neutralization; when a privileged user (e.g., a site administrator) views the affected page, the script executes in their authenticated browser session and can act on their behalf. No verified public exploit code is available - the only reference is the Patchstack database entry. The scope-change flag indicates the payload executes in the victim's browser security context rather than the plugin's, and the attack additionally requires the victim to view the affected page (UI:R).