W3 Total Cache <=2.10.3 Unauthenticated Stored XSS via Comment Author Name (CVE-2026-18109)

Vulnerability Overview Vulnerability Name: W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name CVE ID: CVE-2026-18109 CVSS Score: 7.2 (High) Release Date: August 13, 2026 Last Updated: August 14, 2026 Researchers: daroo Affected Versions Affected Versions: W3 Total Cache <= 2.10.3 Fixed Version: 2.10.4 Remediation Recommendation: Upgrade to patched version 2.10.4 or higher. Description The W3 Total Cache plugin for WordPress suffers from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute when users visit the affected pages. This vulnerability occurs exclusively during the img tag rewriting step when the LazyLoad Images feature of W3 Total Cache is enabled. References plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Slug: w3-total-cache Fixed: Yes Affected Versions: <= 2.10.3 Fixed Version: 2.10.4 Recent Vulnerabilities W3 Total Cache <= 2.10.2 - Unauthenticated Path Traversal - CVE ID: CVE-2026-66695 - CVSS Score: 5.3 - Researchers: Mykel Nelson - Date: July 31, 2026 W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via parameter - CVE ID: CVE-2026-9282 - CVSS Score: 7.5 - Researchers: snr - Date: July 10, 2026 W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary Code Execution - CVE ID: CVE-2026-57623 - CVSS Score: 8.1 - Researchers: Ananda Dhakai - Date: June 29, 2026 W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header - CVE ID: CVE-2026-5032 - CVSS Score: 7.5 - Researchers: wesley (wcraft) - Date: April 1, 2026 W3 Total Cache <= 2.9.1 - Missing Authorization - CVE ID: CVE-2026-39595 - CVSS Score: 4.3 - Researchers: Muhammad Sharief - Date: March 12, 2026 W3 Total Cache <= 2.9.1 - Unauthenticated Arbitrary Code Execution - CVE ID: CVE-2026-27384 - CVSS Score: 9.8 - Researchers: CODE WHITE GmbH - Date: February 24, 2026 W3 Total Cache <= 2.8.12 - Unauthenticated Command Injection - CVE ID: CVE-2025-9501 - CVSS Score: 8.1 - Researchers: wesley (wcraft) - Date: October 27, 2025 W3 Total Cache <= 2.8.1 - Missing Authorization for Authenticated (Subscriber) Users to Server-Side Request Forgery - CVE ID: CVE-2024-12365 - CVSS Score: 8.5 - Researchers: villu164 - Date: January 13, 2025 W3 Total Cache <= 2.8.1 - Missing Authorization Leading to Unauthenticated Plugin Deactivation and Extension Activation/Deactivation - CVE ID: CVE-2024-12006 - CVSS Score: 5.3 - Researchers: villu164 - Date: January 13, 2025 W3 Total Cache <= 2.8.1 - Information Exposure via Log Files - CVE ID: CVE-2024-12008 - CVSS Score: 5.3 - Researchers: villu164 - Date: January 13, 2025 More Information View More Vulnerabilities for This Package: View More Copyright Copyright: © 2012-2026 Defiant Inc. All Rights Reserved. Contact Us Contact Us: wh-support@wordfence.com Business Hours Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays). Response Time: 24/7 support with a 1-hour response time. Terms of Service Terms of Service: Terms of Service Privacy Policy: Privacy Policy Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram Products Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central Support Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Advanced Support: Advanced Support News Blog: Blog News: News Vulnerability Advisory: Vulnerability Advisory About About Wordfence: About Wordfence Affiliate Program: Affiliate Program Careers: Careers Contact: Contact Security: Security CVE Request Form: CVE Request Form Stay Updated Subscribe to News and Updates: Subscribe Terms of Service and Privacy Policy Agree to Terms of Service and Privacy Policy: Agree Register Register: Register Copyright Copyright: © 2012-2026 Defiant Inc. All Rights Reserved. Logo Wordfence Logo: Wordfence Logo Other Other: Other Summary Vulnerability Overview: W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting Affected Versions: W3 Total Cache <= 2.10.3 Remediation: Upgrade to patched version 2.10.4 or higher Additional Information Software Type: Plugin Software Slug: w3-total-cache Fixed: Yes Affected Versions: <= 2.10.3 Fixed Version: 2.10.4 Recent Vulnerabilities W3 Total Cache <= 2.10.2 - Unauthenticated Path Traversal - CVE ID: CVE-2026-66695 - CVSS Score: 5.3 - Researchers: Mykel Nelson - Date: July 31, 2026 W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via parameter - CVE ID: CVE-2026-9282 - CVSS Score: 7.5 - Researchers: snr - Date: July 10, 2026 W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary Code Execution

Goal Reached Thanks to every supporter — we hit 100%!

W3 Total Cache <=2.10.3 Unauthenticated Stored XSS via Comment Author Name (CVE-2026-18109)

More from this source