Description

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the "Lazy Load Images" feature with "Process background images" to be enabled, and the malicious comment to be approved by a moderator before execution is triggered.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-05T07:17:12.580Z",
  "pubdate": "2026-09-05T07:17:12.580Z",
  "executiveSummary": "The W3 Total Cache plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, identified in all versions up to and including 2.10.5. This security flaw originates from improper sanitization of user-supplied data within the comment content handling process when the 'Lazy Load Images' feature is active.\nThe vulnerability allows unauthenticated attackers to inject malicious JavaScript payloads into website comments. Once these comments are approved by a moderator, the scripts are stored persistently within the application database. When an end-user or administrator views the page containing the malicious comment, the injected script executes within the context of the victim's browser session.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of the user, and unauthorized modification of the website's visual content. The requirement for moderator approval acts as a minor hurdle but does not negate the critical risk posed by the lack of robust input validation and output encoding. Users are advised to exercise caution regarding comment moderation and prioritize updating to a secure version as soon as a patch is available.",
  "technicalDetails": "The vulnerability resides within the 'LazyLoad Background Mutator' functionality of the W3 Total Cache plugin. The root cause is the failure to properly sanitize and escape comment content before it is processed by the lazy loading mechanism. When the 'Lazy Load Images' feature is enabled with 'Process background images' configured, the plugin improperly handles strings that are parsed during the generation of the page's output.\nThe attack flow commences when an unauthenticated attacker submits a specially crafted comment containing malicious HTML or JavaScript payloads. Under normal circumstances, WordPress sanitizes comment input; however, the plugin’s background mutator logic performs additional, flawed processing on the comment body during the HTML rendering phase. Because the plugin injects this content into the DOM without sufficient output encoding, the browser interprets the injected script tags as executable code rather than plain text.\nExploitation requires the target environment to have 'Lazy Load Images' and 'Process background images' enabled within the W3 Total Cache settings. Furthermore, the payload must be processed by a moderator, meaning the attacker relies on the target's internal moderation workflow. Once the comment status transitions to 'approved', the malicious script is rendered on every page view where the LazyLoad functionality triggers on that comment.\nThe payload executes in the victim's browser session with the permissions assigned to the current user. If a logged-in administrator views the comment, the script can perform actions with administrative privileges, such as creating new administrative accounts, exfiltrating sensitive cookies, or redirecting users to malicious domains. The vulnerability persists until the comment is deleted from the database or the plugin is updated to mitigate the unsafe processing of the attribute strings. The failure to sanitize input at the entry point combined with inadequate output escaping during the mutation phase defines this as a classic Stored XSS vector, exposing the integrity and confidentiality of the affected WordPress site."
}