EUVD-2026-71882
GHSA-6p3q-4gcg-xv4v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
UI:R corrected from vendor UI:N because stored XSS requires a victim to visit the page; all other metrics retained.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the "Lazy Load Images" feature with "Process background images" to be enabled, and the malicious comment to be approved by a moderator before execution is triggered.
AnalysisAI
Stored Cross-Site Scripting in W3 Total Cache (WordPress plugin) versions up to and including 2.10.5 allows unauthenticated attackers to inject arbitrary JavaScript via comment content processed by the LazyLoad Background Mutator. The flaw stems from insufficient sanitization and output escaping in UserExperience_LazyLoad_Mutator.php, specifically where comment text containing background-image CSS is mutated for lazy loading. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two non-default feature conditions must both be active: (1) the 'Lazy Load Images' feature in W3 Total Cache must be enabled, and (2) the 'Process background images' sub-option within that feature must also be enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.2 score with AV:N/AC:L/PR:N/UI:N/S:C overstates realistic exploitability in two ways: UI:N misrepresents stored XSS, which inherently requires a victim to visit the page, and the score does not account for the moderator-approval prerequisite that gates payload delivery. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade W3 Total Cache to version 2.10.6 or later; the fix is confirmed in the official WordPress plugin repository changeset (https://plugins.trac.wordpress.org/changeset/3680101/w3-total-cache/tags/2.10.6/UserExperience_LazyLoad_Mutator.php). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, update W3 Total Cache to version 2.10.6 on all affected WordPress installations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in W3 Total Cache
View allThe W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.
W3 Total Cache plugin for WordPress exposes security tokens to unauthenticated remote attackers through User-Agent heade
pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via
The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attack
The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulne
Unauthenticated arbitrary code execution affects the W3 Total Cache WordPress caching plugin in all versions up to and i
The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high priv
Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is e
Stored cross-site scripting in W3 Total Cache WordPress plugin (all versions through 2.10.3) allows unauthenticated atta
Path traversal in W3 Total Cache WordPress plugin (versions ≤ 2.10.2) enables remote unauthenticated attackers to manipu
W3 Total Cache for WordPress (versions through 2.9.1) exposes Author-role users to administrative plugin functions due t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today