CVE-2026-18109

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions prior to 2.10.4

Description The W3 Total Cache plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through the comment author name, which execute when a user views the affected page. This issue is only exploitable if the Lazy Load Images feature is enabled, as the unsafe re-emission happens during the img tag rewriting process of the LazyLoad mutator.

Recommendations Update W3 Total Cache to version 2.10.4 or later. As a temporary mitigation, disable the Lazy Load Images feature.