{"id":"CVE-2026-111254","kind":"vulnerability","aliases":["CVE-2026-111254"],"related":[],"title":"W3 Total Cache WordPress plugin: stored XSS via comment parameter","description":"The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Pro license was previously active with REST caching enabled and has since become inactive while Disk Enhanced page caching remains configured, and that the attacker holds a previously approved commenter identity.","summary":"The W3 Total Cache WordPress plugin fails to sanitize the 'comment' parameter, so stored script injected through it runs in the browser of any user who opens an affected page. An unauthenticated attacker who holds a previously approved commenter identity can plant the script.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","w3-total-cache","wordpress"],"not_affected_if":["auth-required","newer-version","no-disk-enhanced-caching","plugin-not-installed"],"how_to_check":"- Check the installed W3 Total Cache version against the plugin's version list in WordPress admin (Plugins page), looking for `2.10.7` or earlier\n- Check whether a Pro license was once active with REST caching enabled and is now inactive, while Disk Enhanced page caching remains configured","fix":"- Update W3 Total Cache to a version later than `2.10.7`; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-10-31T07:16:34+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","triaged_at":"2026-10-31T07:34:37+00:00","updated_at":"2026-10-31T07:34:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T07:34:37Z","model":"claude-haiku-5-5","output":{"fix":"- Update W3 Total Cache to a version later than `2.10.7`; the exact fixed version is unknown from the sources","reach":"internet","title":"W3 Total Cache WordPress plugin: stored XSS via comment parameter","impact":"medium","summary":"The W3 Total Cache WordPress plugin fails to sanitize the 'comment' parameter, so stored script injected through it runs in the browser of any user who opens an affected page. An unauthenticated attacker who holds a previously approved commenter identity can plant the script.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","w3-total-cache","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Injected script runs in visitors' browsers and admin sessions","analyst_note":"Confirm the fixed version after 2.10.7 and the exact vendor advisory from the WordPress plugin changelog; the NVD entry alone does not give a fix.","how_to_check":"- Check the installed W3 Total Cache version against the plugin's version list in WordPress admin (Plugins page), looking for `2.10.7` or earlier\n- Check whether a Pro license was once active with REST caching enabled and is now inactive, while Disk Enhanced page caching remains configured\n- unknown for further detail","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version","no-disk-enhanced-caching","auth-required"],"who_is_affected":"Sites running W3 Total Cache 2.10.7 or earlier are exposed only when the Pro license has lapsed while REST caching was enabled and Disk Enhanced page caching is still configured. The attacker also needs a commenter identity that a site admin has approved. Sites that do not run the plugin, or that do not match this configuration, can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000765,"input_tokens":4233,"output_tokens":683,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111254':13A,16A '-2026':12A,15A '2.10.7':96C 'access':125C 'activ':137C 'affect':54B 'approv':63B,161C 'arbitrari':114C 'attack':58B,111C,157C 'becom':145C 'browser':47B 'cach':3A,24B,29B,73C,140C,151C 'comment':9A,36B,64B,87C,162C 'configur':153C 'cross':82C 'cross-sit':81C 'cve':11A,14A 'disk':148C 'due':97C 'enabl':141C 'enhanc':149C 'escap':104C 'execut':121C 'exploit':129C 'fail':32B 'hold':60B,158C 'host':20B 'ident':65B,163C 'inact':146C 'includ':95C 'inject':41B,113C,127C 'input':100C 'insuffici':99C 'licens':134C 'make':106C 'open':52B 'output':103C 'packag':17B 'page':55B,118C,128C,150C 'paramet':10A,37B,88C 'plant':67B 'plugin':5A,31B,74C 'possibl':108C 'previous':62B,136C,160C 'pro':133C 'remain':152C 'requir':130C 'rest':139C 'run':44B 'sanit':34B,101C 'script':40B,69B,84C,116C 'self':19B 'self-host':18B 'sinc':144C 'site':83C 'store':6A,39B,80C 'total':2A,23B,28B,72C 'unauthent':57B,110C 'user':50B,124C 'version':91C 'via':8A,85C 'vulner':78C 'w3':1A,22B,27B,71C 'w3-total-cache':21B 'web':115C 'whenev':122C 'wordpress':4A,25B,30B,76C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running W3 Total Cache 2.10.7 or earlier are exposed only when the Pro license has lapsed while REST caching was enabled and Disk Enhanced page caching is still configured. The attacker also needs a commenter identity that a site admin has approved. Sites that do not run the plugin, or that do not match this configuration, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T07:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111254","severity":null,"published_at":"2026-10-31T07:16:34+00:00","modified_at":"2026-10-31T07:16:34+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","fetched_at":"2026-10-31T07:34:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}