CVE-2026-111254: Cross-site scripting in W3 Total Cache

Summary

• What it is: A Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-111254, affecting the W3 Total Cache plugin.

• Who it affects: WordPress sites using W3 Total Cache versions 2.10.7 and earlier.

• Is it patched: Yes, a patch is available in version 2.11.0.

• Is it being exploited: No evidence indicates active exploitation.

Affected and patched versions

• W3 Total Cache (plugin w3-total-cache): affected 2.10.7 and earlier; fixed in 2.11.0

Is my site vulnerable?

To determine if your WordPress site is vulnerable to CVE-2026-111254, check the installed version of the W3 Total Cache plugin. Sites running W3 Total Cache versions 2.10.7 or earlier are affected.

You can verify your plugin version through the WordPress admin dashboard:

1. Log in to your WordPress admin area.

2. Navigate to the "Plugins" menu item.

3. Locate "W3 Total Cache" in the list of installed plugins.

4. The version number is displayed next to the plugin name.

Alternatively, you can check the plugin's readme.txt file via FTP or your hosting file manager. The readme.txt file is located in the wp-content/plugins/w3-total-cache/ directory and contains the version information.

If your site uses W3 Total Cache version 2.10.7 or an earlier release, it is vulnerable if the specific exploitation conditions are met.

What an attacker actually does

CVE-2026-111254 allows unauthenticated attackers to inject arbitrary web scripts into pages on a WordPress site using the W3 Total Cache plugin. This vulnerability stems from insufficient input sanitization and output escaping within the plugin, specifically affecting the 'comment' parameter. Once injected, these malicious scripts will execute in the browser of any user who accesses an affected page.

The successful exploitation of this Stored Cross-Site Scripting (XSS) vulnerability requires a specific set of environmental conditions on the target site. First, the site must have previously held an active W3 Total Cache Pro license with REST caching enabled. This Pro license must then have become inactive. Concurrently, the site's Disk Enhanced page caching must remain configured and active. These conditions suggest a scenario where certain caching configurations persist even after a Pro license expires, creating an exploitable state.

In addition to these caching and licensing prerequisites, the attacker must possess a previously approved commenter identity on the site. This means the attacker would have needed to submit a comment that was approved by a site administrator at some point in the past. With these conditions met, an unauthenticated attacker can use their approved commenter identity to inject malicious web scripts through the 'comment' parameter. When a user visits a page containing the compromised cached content, the injected script executes within their browser, potentially leading to session hijacking, redirection to malicious sites, defacement of the page, or other client-side attacks.

How to detect a compromise

Detecting a compromise related to CVE-2026-111254 involves looking for unusual script injections within cached content or approved comments, especially on sites that meet the specific exploitation conditions. Since this is a Stored XSS vulnerability, the malicious script would reside within the site's content or cache.

Indicators of compromise may include:

• Unexpected script execution: Users report unusual pop-ups, redirects, or changes in page behavior when visiting specific pages on your site.

• Malicious code in page source: Inspecting the source code of cached pages, particularly those displaying comments, for <script> tags or other HTML elements containing JavaScript that were not legitimately added. Look for obfuscated or unusual code within comment sections.

• Database inspection: Examine the wp_comments table in your WordPress database for suspicious content in the comment_content field, especially from previously approved commenter IDs. Search for script tags or encoded JavaScript.

• Cached file inspection: If Disk Enhanced page caching is active, inspect the cached HTML files generated by W3 Total Cache for injected scripts. These files are typically found within the wp-content/cache/page_enhanced/ directory structure. Look for files that contain unexpected JavaScript within the comment sections.

• Server access logs: Review server access logs for unusual requests related to comment submission or cache regeneration, particularly from IP addresses associated with known or suspected attackers.

• W3 Total Cache configuration: Verify the current and past configurations of W3 Total Cache. Confirm if a Pro license was previously active with REST caching enabled and subsequently became inactive, while Disk Enhanced page caching remains configured.

A manual check for suspicious script content in cached files can be performed using command-line tools. For example, you can use grep to search for script tags within your W3 Total Cache enhanced page cache directory:

grep -r "<script" /path/to/your/wordpress/wp-content/cache/page_enhanced/

Replace /path/to/your/wordpress/ with the actual path to your WordPress installation. This command will recursively search for the string "<script" in all files within the specified cache directory, which may help identify injected scripts. Review any findings carefully to distinguish legitimate scripts from malicious injections.

How to fix

To address CVE-2026-111254 and protect your WordPress site, update the W3 Total Cache plugin to a patched version.

Follow these steps to remediate the vulnerability:

1. Backup your site: Before performing any updates, create a complete backup of your WordPress site's files and database. This ensures you can restore your site if any issues arise during the update process.

2. Update W3 Total Cache: Update the W3 Total Cache plugin to version 2.11.0 or later. You can do this through the WordPress admin dashboard:

   • Log in to your WordPress admin area.

   • Navigate to "Plugins" > "Installed Plugins".

   • Locate "W3 Total Cache" in the list.

   • If an update is available, a notice will appear below the plugin name. Click "Update Now".

   • If the update option is not visible, you may need to manually update the plugin. Download the latest version from the WordPress plugin directory and upload it via FTP, replacing the existing plugin files.

3. Clear all caches: After updating, clear all caches managed by W3 Total Cache to ensure any potentially compromised cached content is removed and new, clean content is generated. This can typically be done from the W3 Total Cache dashboard or by using the "Empty All Caches" option in the WordPress admin bar.

4. Review comments: As a precautionary measure, review recent approved comments on your site for any suspicious content, especially if your site met the exploitation conditions. Remove any comments that appear to contain malicious scripts.

Timeline

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-111254

• https://www.wordfence.com/threat-intel/vulnerabilities/id/0169909e-c6cd-4d08-8301-5e09fce4429c

• https://wordpress.org/plugins/w3-total-cache/

• https://www.tenable.com/cve