CVE-2026-120019

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions prior to 2.10.8

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the comment parameter. Exploitation requires the HTML Minify feature to be enabled with the default 'mfunc' entry in the ignored-comment stems list. Additionally, the attacker must predict the md5(time()) placeholder namespace by analyzing the server clock through the HTTP Date response header.

Recommendations Update W3 Total Cache to version 2.10.8 or later. As a temporary mitigation, disable the HTML Minify feature.