W3 Total Cache EUVD-2026-114597

Exploitation requires HTML Minify to be enabled AND the default 'mfunc' entry to be present in the ignored-comment stems list; both conditions must hold for the injected 'comment' content to survive minification. Additionally, the attacker must successfully predict the md5(time()) placeholder namespace, which they derive by reading the server clock from the HTTP Date response header, and the prediction only succeeds within the applicable time window. Limiting factors: HTML Minify is a non-default-on feature, the timing/namespace-prediction requirement (reflected as AC:H) reduces reliability, and impact is realized only when a user subsequently loads the injected page. No authentication is required (PR:N).

This is a genuine but conditional, moderate-severity issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, base 5.4) shows an unauthenticated (PR:N) network-reachable stored XSS with only Low confidentiality and integrity impact and a scope change, but crucially carries AC:H - and the description tells us exactly why: exploitation depends on the attacker predicting the md5(time()) placeholder namespace by reading the server clock from the HTTP Date response header within a limited time window, and on a specific feature state (HTML Minify enabled with the default 'mfunc' entry in the ignored-comment stems list). vuln.today assigns a 'this_month' decision label, consistent with a real-but-not-urgent priority. No EPSS score, no CISA KEV listing, and no SSVC decision record were supplied, so exploitation probability and automatability cannot be quantified from this input. No working exploit is referenced - the links are the Wordfence advisory and source/patch artifacts, not exploit code. Net: a legitimately exploitable unauthenticated stored XSS in a very widely deployed plugin, but the AC:H timing/prediction requirement and the feature-state precondition meaningfully reduce real-world likelihood versus the raw 'unauthenticated network' framing; patch on a normal priority cycle rather than as a drop-everything emergency.

On a site running W3 Total Cache (<=2.10.7) with HTML Minify enabled and the default 'mfunc' ignored-comment stem present, an unauthenticated attacker submits a crafted 'comment' value and reads the server's HTTP Date response header to predict the md5(time()) placeholder namespace used by the minifier within the applicable window. If the prediction lands, the attacker's script is stored and preserved through minification so it executes in the browser of any user who later loads the injected page. No public exploit code is referenced; the AC:H timing-prediction step makes reliable exploitation non-trivial.