{"id":"CVE-2026-114178","kind":"vulnerability","aliases":["CVE-2026-114178"],"related":[],"title":"W3 Total Cache WordPress plugin: stored XSS through version 2.10.7","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.","summary":"W3 Total Cache, a WordPress caching plugin by Bold Grid, has a stored cross-site scripting flaw in versions through 2.10.7. An attacker who can submit input that the plugin saves can get script to run in the browser of anyone who views the affected page, such as an administrator.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","w3-total-cache","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed W3 Total Cache version in the WordPress admin plugins list, or with `wp plugin get w3-total-cache --field=version`\n- Compare the result against `2.10.7`; versions at or below it are in the stated range","fix":"- Update W3 Total Cache to a version later than `2.10.7` (the exact fixed version is unknown from the sources)\n- Until updated, restrict who holds contributor or higher roles on the WordPress site","status":"open","published_at":"2026-10-24T08:16:51+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","triaged_at":"2026-10-25T03:31:09+00:00","updated_at":"2026-10-25T03:31:09+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:31:09Z","model":"claude-haiku-5-5","output":{"fix":"- Update W3 Total Cache to a version later than `2.10.7` (the exact fixed version is unknown from the sources)\n- Until updated, restrict who holds contributor or higher roles on the WordPress site","reach":"internet","title":"W3 Total Cache WordPress plugin: stored XSS through version 2.10.7","impact":"medium","summary":"W3 Total Cache, a WordPress caching plugin by Bold Grid, has a stored cross-site scripting flaw in versions through 2.10.7. An attacker who can submit input that the plugin saves can get script to run in the browser of anyone who views the affected page, such as an administrator.","category":"package","nicknames":[],"who_cares":["wordpress","w3-total-cache","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Script runs in an admin's browser, enabling account takeover","analyst_note":"Confirm the fixed version and the exact input path and required role from the NVD entry or the plugin changelog.","how_to_check":"- Check the installed W3 Total Cache version in the WordPress admin plugins list, or with `wp plugin get w3-total-cache --field=version`\n- Compare the result against `2.10.7`; versions at or below it are in the stated range","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running W3 Total Cache 2.10.7 or earlier on WordPress. The sources do not say which plugin settings or user roles make the stored input reachable, so exposure beyond the installed version is unknown. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000632,"input_tokens":3318,"output_tokens":601,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114178':13A,16A '-2026':12A,15A '2.10.7':10A,47B,111C 'administr':76B 'affect':71B,104C 'allow':100C 'anyon':67B 'attack':49B 'bold':34B,91C 'browser':65B 'cach':3A,24B,28B,31B,95C,99C,107C 'cross':40B,86C 'cross-sit':39B,85C 'cve':11A,14A 'flaw':43B 'generat':84C 'get':59B 'grid':35B,92C 'host':20B 'improp':77C 'input':53B,80C 'issu':103C 'n/a':109C 'neutral':78C 'packag':17B 'page':72B,83C 'plugin':5A,32B,56B 'run':62B 'save':57B 'script':42B,60B,88C 'self':19B 'self-host':18B 'site':41B,87C 'store':6A,38B,101C 'submit':52B 'total':2A,23B,27B,94C,98C,106C 'version':9A,45B 'view':69B 'vulner':89C 'w3':1A,22B,26B,93C,97C,105C 'w3-total-cache':21B,96C 'web':82C 'wordpress':4A,25B,30B 'xss':7A 'xss.this':102C","nicknames":[],"mitigations":[],"who_affected":"Sites running W3 Total Cache 2.10.7 or earlier on WordPress. The sources do not say which plugin settings or user roles make the stored input reachable, so exposure beyond the installed version is unknown. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T08:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114178","severity":null,"published_at":"2026-10-24T08:16:51+00:00","modified_at":"2026-10-24T08:16:51+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","fetched_at":"2026-10-24T08:47:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}