CVE-2026-78438

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions prior to 2.10.6

Description Insufficient input sanitization and output escaping in the LazyLoad Background Mutator allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs when malicious web scripts are injected via comment content and subsequently execute when a user accesses the affected page. This issue requires the Lazy Load Images feature with Process background images enabled and requires a moderator to approve the malicious comment before the script is triggered.

Recommendations Update W3 Total Cache to version 2.10.6 or later. As a temporary mitigation, disable the Lazy Load Images feature or the Process background images option.