Vendor

W3 EDGE

2 briefs RSS

Stored Cross-Site Scripting in W3 Total Cache

The W3 Total Cache plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability, CVE-2026-87920, allowing unauthenticated attackers to execute arbitrary web scripts via flawed Output-Buffer Regex rewriting.

W3 Total Cache xss web-application wordpress cve-2026-87920

2t 1c 2w ago

high advisory

Stored XSS in W3 Total Cache Plugin for WordPress

1 TTP 1 CVE

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the LazyLoad Background Mutator, allowing unauthenticated attackers to execute arbitrary scripts after moderator approval.

W3 Total Cache web-security xss wordpress cve-2026-78438

1t 1c Sep 5, 2026