Stored Cross-Site Scripting Vulnerability in W3 Total Cache Plugin for WordPress

CVE-2026-111254

What is CVE-2026-111254?

The W3 Total Cache plugin for WordPress is susceptible to stored cross-site scripting via the 'comment' parameter in all versions up to and including 2.10.7. This vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. When successful, these scripts can be executed in the context of users visiting affected pages, potentially compromising user accounts or revealing sensitive data. Successful exploitation requires that the plugin had a Pro license with REST caching enabled, which later became inactive, while keeping Disk Enhanced page caching enabled, along with the attacker possessing an approved commenter identity.

References