CVE-2026-114178: WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
w3-total-cacheto a version that resolves this vulnerability.Fixed in 2.11.0
Event History
Frequently Asked Questions
Who can exploit this issue?
The vector is network-accessible and no attacker privileges are required, but exploitation requires user interaction. The available data does not identify the specific interaction or injection point.
Are default installations affected?
The issue affects W3 Total Cache through version 2.10.7. The available data does not state whether a particular feature, configuration, or default setting is required.
What is the potential impact?
This is a stored XSS issue with low impacts to confidentiality, integrity, and availability. Because the scope is changed, successful script execution may affect a security authority beyond the vulnerable component.
How can I determine whether my site is affected?
Check whether the site uses the BoldGrid W3 Total Cache plugin and identify its installed version. Versions up to and including 2.10.7 are within the stated affected range.