CVE-2026-87920: W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'Remove query strings from static resources' option is enabled in W3 Total Cache, as mutateurl() must strip the '?' delimiter and everything following it — including the closing quote of the outer attribute — to break the attribute boundary.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the 'Remove query strings from static resources' option in W3 Total Cache.
W3 Total Cache for WordPress Remove query strings from static resources = disabled
Event History
Frequently Asked Questions
What configuration makes this issue exploitable?
Exploitation requires the W3 Total Cache “Remove query strings from static resources” option to be enabled. The vulnerable rewrite behavior must remove the question-mark delimiter and everything after it, including an outer attribute’s closing quote.
Does an attacker need an account or user interaction to inject the payload?
No account or prior privileges are required to inject the stored script. The injected script executes when someone later accesses a page containing the injected content.
Who is exposed to the injected script?
Users who access a page containing the attacker-injected content may execute the stored script in their browser. The issue affects W3 Total Cache versions through 2.10.6 when the required option is enabled.
What can be done if updating is not immediately possible?
Disable the “Remove query strings from static resources” option in W3 Total Cache. The provided information states that the vulnerability is only exploitable when this option is enabled.