Stored Cross-Site Scripting Vulnerability in W3 Total Cache Plugin for WordPress

CVE-2026-120019

What is CVE-2026-120019?

The W3 Total Cache plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability via the 'comment' parameter. This issue arises from inadequate input sanitization and output escaping across all versions up to 2.10.7. It allows unauthenticated attackers to inject arbitrary web scripts into web pages, executing the scripts on user browsers when they access the affected pages. The exploitation relies on specific conditions, including enabling HTML Minify with the default 'mfunc' entry in the ignored-comment stems list and predicting a specific md5 placeholder via the HTTP Date response header.

References