CVE-2026-120019: Stored XSS in W3 Total Cache up to 2.10.7

CVE-2026-120019 is a Stored Cross-Site Scripting (XSS) vulnerability in the W3 Total Cache plugin for WordPress, widely installed by system administrators to optimize caching and performance. The flaw lies in insufficient handling of the 'comment' parameter: an unauthenticated attacker can inject arbitrary JavaScript code that persists on the server and executes in every visitor's browser, compromising sessions, credentials, or sensitive data.

CVSS is 5.4 (medium), but the context is relevant: the XSS is stored (persistent, not reflected) in a plugin present on millions of WordPress sites. However, the exploit has specific and complex prerequisites: HTML Minify must be active, 'mfunc' must be in the ignored-comment stems list (default configuration), and the attacker must guess the md5(time()) namespace by reading the HTTP Date header within a narrow time window. The vulnerability has been known to NVD since October 31, 2026; on November 4, references appeared on GitHub, signaling that the CVE is circulating in the community.

For defenders: immediately verify which version of W3 Total Cache is installed across all managed WordPress sites. Check whether HTML Minify is enabled in the plugin settings; if it is, disable it temporarily until an official patch is available. Monitor access logs and comments for anomalous activity or suspicious scripts. Plan an update to a version after 2.10.7 as soon as it is available. Verify that your corporate WAF is configured to detect and block XSS attempts.