CVE-2026-120019 in W3 Total Cache Plugin
Summary
by MITRE • 10/31/2026
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires HTML Minify to be enabled with the default 'mfunc' entry present in the ignored-comment stems list, and exploitation depends on the attacker predicting the md5(time()) placeholder namespace by reading the server clock via the HTTP Date response header within the applicable time window.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/01/2026
The W3 Total Cache plugin for WordPress contains a critical stored cross-site scripting vulnerability affecting all versions up to and including 2.10.7. This flaw stems from insufficient input sanitization and output escaping mechanisms when processing user-supplied data, specifically within the comment parameter of the application's functionality. The security deficiency allows unauthenticated attackers to inject arbitrary web scripts into pages hosted on the vulnerable WordPress site. When these injected payloads are stored in the database or file system, they persist until manually removed by an administrator, creating a persistent threat vector that targets any user who subsequently accesses the compromised page.
The exploitation of this vulnerability is contingent upon specific configuration states within the W3 Total Cache plugin. Specifically, HTML Minify must be enabled on the target site, and the default ignored-comment stems list must contain the mfunc entry. This particular configuration creates a code execution pathway where attacker-controlled input can bypass standard filtering routines. The attack relies heavily on timing precision because the exploitation mechanism depends on predicting an md5(time()) placeholder namespace used by the plugin's minification engine. Attackers are required to read the server clock via the HTTP Date response header within a narrow time window to accurately calculate this hash, thereby ensuring their malicious script is executed rather than stripped or ignored during the page rendering process.
From a technical perspective, this vulnerability represents a classic case of improper neutralization of special elements used in an HTML document (CWE-79). The failure to properly sanitize input before storage and escape output before display allows client-side code injection. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior aligns with the T1059 technique for Command and Scripting Interpretation, specifically under sub-techniques involving web-based scripting languages like JavaScript (T1059.007). The stored nature of the XSS payload classifies it further within the persistence tactics often seen in advanced persistent threats or defacement campaigns where long-term access to user sessions is desired.
The operational impact of this vulnerability is severe, as successful exploitation leads to arbitrary code execution within the context of the victim's browser session against the vulnerable website. Attackers can steal sensitive information such as administrative cookies, session tokens, and personally identifiable data stored in local storage or cookies. Furthermore, they can perform actions on behalf of authenticated users, including modifying site content, defacing web pages, or redirecting traffic to malicious sites designed for phishing or malware distribution. Since the attack requires no authentication, any visitor to a page containing the injected payload becomes a potential victim, significantly expanding the blast radius beyond just administrative accounts.
Mitigation strategies should prioritize immediate remediation through software updates. Administrators running W3 Total Cache versions up to 2.10.7 must upgrade to the latest patched version released by the plugin developers as soon as possible. If an update is not immediately feasible, temporary workarounds include disabling HTML Minify or removing the mfunc entry from the ignored-comment stems list within the plugin configuration, although this may impact site performance metrics. Additionally, implementing a Web Application Firewall with robust cross-site scripting detection rules can help block exploitation attempts in transit by identifying and filtering out malicious script injections before they reach the application logic. Regular security audits and input validation practices should also be enforced to prevent similar vulnerabilities from arising in custom code or other plugins that interact with user inputs.