Stored Cross-Site Scripting Vulnerability in W3 Total Cache Plugin for WordPress

CVE-2026-18109

What is CVE-2026-18109?

The W3 Total Cache plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in the Comment Author Name field. This issue is present in versions up to and including 2.10.3. Exploitation of this vulnerability requires the Lazy Load Images feature to be enabled, allowing unauthenticated attackers to inject arbitrary scripts. These scripts can execute in the browsers of users accessing affected pages, potentially leading to data theft or session hijacking. It's crucial for users to update their plugins to version 2.10.4 or later to mitigate this risk.

References