---
id: "CVE-2026-114178"
kind: "vulnerability"
aliases: ["CVE-2026-114178"]
title: "W3 Total Cache WordPress plugin: stored XSS through version 2.10.7"
severity: "high"
cvss: 7.1
epss: 0.00251
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "w3-total-cache", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-24T08:16:51+00:00"
first_seen_at: "2026-10-24T08:47:15+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114178", "first_seen_at": "2026-10-24T08:47:15+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114178", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# W3 Total Cache WordPress plugin: stored XSS through version 2.10.7

W3 Total Cache, a WordPress caching plugin by Bold Grid, has a stored cross-site scripting flaw in versions through 2.10.7. An attacker who can submit input that the plugin saves can get script to run in the browser of anyone who views the affected page, such as an administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed W3 Total Cache version in the WordPress admin plugins list, or with `wp plugin get w3-total-cache --field=version`
- Compare the result against `2.10.7`; versions at or below it are in the stated range

## Fix

- Update W3 Total Cache to a version later than `2.10.7` (the exact fixed version is unknown from the sources)
- Until updated, restrict who holds contributor or higher roles on the WordPress site

## Timeline

- 2026-10-24T08:47:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114178
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114178

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_