CVE-2026-111254

HighCVSS 7.2/10Last modified Nov 2, 2026

Description

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Pro license was previously active with REST caching enabled and has since become inactive while Disk Enhanced page caching remains configured, and that the attacker holds a previously approved commenter identity.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
boldgrid	W3 Total Cache	<= 2.10.7

References

Timeline

Published: Oct 31, 2026
Last modified: Nov 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1112557.5The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all CVE-2026-111256When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods CVE-2026-111257With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-kno CVE-2026-111258The optional request routing feature forwards requests to their configured destination without applying the security constraints of that des CVE-2026-111259The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who ob CVE-2026-111264.3Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malic CVE-2026-111260The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number gen CVE-2026-111261The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some CVE-2026-111262The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A r CVE-2026-111263Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published withi CVE-2026-111264The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthen CVE-2026-1112696.1libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding in