Executive brief
The W3 Total Cache plugin for WordPress is vulnerable to stored cross-site scripting (XSS) in comment content when the lazy load image feature is enabled. An unauthenticated attacker can inject malicious scripts into approved comments, which will then execute in the browsers of site visitors, potentially allowing account hijacking, data theft, or defacement without any user interaction beyond visiting an affected page.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the LazyLoad Background Mutator component that fails to properly sanitize and escape user-supplied comment content. When the "Lazy Load Images" feature with "Process background images" is enabled, an unauthenticated attacker can inject arbitrary web scripts via comment fields. The injected script persists in the database and executes in the context of any user viewing the page. Exploitation requires the malicious comment to be approved by a moderator, and the feature to be enabled. The vulnerability affects W3 Total Cache versions up to and including 2.10.5.
Affected products
- W3 Edge W3 Total Cache up to and including 2.10.5
Timeline
- 2026-09-05: disclosed