WordPress security changelog
HIGH CVE-2026-18109 Deferred

W3 Total Cache lazy loading permits unauthenticated stored XSS

W3 Total Cache through 2.10.3 permits an unauthenticated commenter to store a malicious Comment Author Name that can execute when Lazy Load Images is enabled. UserExperience_LazyLoad_Mutator::tag_img_content_replace() used regular-expression replacements that could treat src= text inside a quoted attribute as a real image attribute and re-emit crafted author content unsafely during lazy-load rewriting. The payload executes when a visitor, including an administrator, views the affected page. Version 2.10.4 restricts replacements to top-level quoted attributes and protects intermediate content with an encoded placeholder. The exact reporter payload is not disclosed.

CVE / CNA score 7.2 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
W3 Total Cache
Plugin slug
w3-total-cache
Affected
<= 2.10.3
Safe version
2.10.4
Published
Aug 14, 2026
Weakness
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This CVE was published Aug 14, 2026 and is one of 23 known issues for this plugin.

What to do

Update, patch or deactivate.

Update to 2.10.4 or later. Until updated, disable Lazy Load Images or untrusted comments as the site's risk warrants. Review comments and invalidate privileged sessions if administrators may have viewed malicious content.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Lazy Load Images feature of W3 Total Cache is enabled, as the unsafe re-emission occurs exclusively within the LazyLoad mutator's img tag rewriting step.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

Primary and upstream sources