W3 Total Cache EUVD-2026-91335

Exploitation requires the 'Remove query strings from static resources' option to be ENABLED in W3 Total Cache - this is the specific, named precondition, because mutate_url() must strip the '?' delimiter and everything after it (including the closing quote of the outer HTML attribute) to break the attribute boundary and inject script. The attack vector is the public comment submission feature, so no authentication is needed (PR:N). Limiting factors: the required option is not the default configuration, affected versions are 2.10.6 and earlier (patched in 2.10.7), and successful script execution depends on a user/administrator subsequently viewing a page that renders the malicious comment. On sites without that caching option enabled, the vector is not exploitable.

This is a genuine but conditional priority rather than a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High) describes a network-reachable, unauthenticated stored XSS with a changed scope (payload executes in the browser context of any visitor), which is consistent with a comment-based stored XSS. The decisive limiting signal, however, is that exploitation is gated on a specific non-default setting - the 'Remove query strings from static resources' option in W3 Total Cache - which must be enabled for mutate_url() to strip the '?' and break the attribute boundary. No EPSS score, CISA KEV entry, or public POC was supplied in the input, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' Signals are broadly consistent (CVSS low-privilege/network vector matches an unauthenticated comment vector), but the real-world risk is lower than the raw 7.2 suggests because the required configuration is not the default, impact is limited to Low confidentiality/integrity (reflected/stored script, no direct server compromise or availability loss), and no exploitation telemetry exists. Prioritize patching on sites known to run the affected plugin with the query-string-removal option enabled; treat it as routine for other deployments.

An unauthenticated attacker submits a blog comment containing a crafted string designed so that, after W3 Total Cache's output-buffer regex rewrite strips the '?' delimiter (and the trailing closing quote of the surrounding HTML attribute), the comment content breaks out of its attribute and injects an executable script. When any subsequent visitor or administrator loads the page that renders that comment, the injected JavaScript runs in their browser session. No public exploit code was identified in the provided data, and the attack only works when the 'Remove query strings from static resources' option is enabled.