CVE-2026-87920

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions prior to 2.10.7

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via comment content. This issue is triggered by an Output-Buffer Regex Rewrite and is only exploitable when the 'Remove query strings from static resources' option is enabled. In this configuration, the mutate url() function strips the '?' delimiter and subsequent characters, which can break the attribute boundary and allow script execution when a user accesses the affected page.

Recommendations Update W3 Total Cache to a version newer than 2.10.6. Disable the 'Remove query strings from static resources' option to mitigate the risk of exploitation.