Description

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Lazy Load Images feature of W3 Total Cache is enabled, as the unsafe re-emission occurs exclusively within the LazyLoad mutator's img tag rewriting step.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-14T03:16:19.363Z",
  "pubdate": "2026-08-14T03:16:19.363Z",
  "executiveSummary": "The W3 Total Cache plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability via the Comment Author Name parameter. This security flaw affects all plugin versions up to, and including, 2.10.3.\nThe vulnerability arises from insufficient input sanitization and output escaping mechanisms applied to user-supplied comment data. Unauthenticated remote attackers can leverage this flaw to inject arbitrary malicious web scripts into web pages managed by the affected WordPress installation.\nThe injected scripts execute within the context of a victim's browser session whenever they access a page containing the malicious payload. Successful exploitation requires a specific configuration precondition: the Lazy Load Images feature of the W3 Total Cache plugin must be enabled by the site administrator.\nThe primary impact of this vulnerability includes unauthorized script execution, session hijacking, credential theft, and potential defacement or manipulation of the rendered web application content. Due to the unauthenticated nature of the attack vector, external malicious actors can interact directly with the exposed comment submission forms to seed the payload without requiring prior privileged access.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate handling of user-supplied input within the commenting subsystem, coupled with unsafe data re-emission during HTML transformation phases. Specifically, the vulnerability resides within the LazyLoad mutator's img tag rewriting step implemented by the W3 Total Cache plugin.\nWhen the Lazy Load Images feature is active, the plugin intercepts rendered HTML output to dynamically modify image attributes, such as replacing the src attribute with a data placeholder and appending original sources to alternative attributes. During this tag rewriting operation, the component improperly processes data derived from the Comment Author Name without enforcing strict input sanitization or context-aware output escaping.\nAn unauthenticated attacker exploits this flaw by supplying a malicious payload containing HTML and JavaScript constructs (such as event handlers or script tags) within the comment author field during the comment submission process. The WordPress application accepts and stores this malicious string in the database as part of the comment metadata.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts a standard HTTP POST request directed at the WordPress comment submission endpoint, inserting the XSS payload into the author parameter. Second, the WordPress core processes and stores the comment. Third, when a user requests the page containing the newly posted comment, the W3 Total Cache plugin intercepts the output buffer. Fourth, the LazyLoad mutator component processes the markup, dynamically rewriting img tags while inadvertently outputting the unsanitized Comment Author Name payload directly into the response body.\nFinally, the victim's browser receives the modified HTML response containing the unescaped script and executes the payload within the security context of the origin site. Because the vulnerability is triggered entirely through standard page views when the specific caching feature is enabled, no privileged authentication or administrative access is required by the attacker to initiate or complete the exploitation sequence."
}