Stored Cross-Site Scripting Vulnerability in W3 Total Cache Plugin for WordPress

CVE-2026-87920

What is CVE-2026-87920?

The W3 Total Cache plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability that arises from inadequate input sanitization and output escaping. This flaw allows attackers to inject and execute arbitrary web scripts on affected pages, impacting users who visit these pages. The issue is particularly dangerous when the 'Remove query strings from static resources' option is activated, as it modifies the URL structure in a way that compromises the integrity of the attribute boundaries, enabling exploitation. Ensuring timely updates and proper configuration of the plugin can mitigate potential risks.

References