W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Cached REST API Responses
- ID
- WPSEC-2026-1410
- Plugin
- W3 Total Cache (w3-total-cache)
- Affected
- all versions before 2.11.0
- Remediation
- Update to 2.11.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-21
- Attack surface
- W3 Total Cache on WPSec AttackSurface
- Fix released
- Published
Description
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cached REST API responses in all versions up to, and including, 2.10.7. When the REST cache mode was left set to 'cache' without Pro active and Page Cache used Disk: Enhanced, REST JSON responses were stored as '.html' static files with no nosniff header, so the web server served them as text/html. This makes it possible for unauthenticated attackers to get markup contained in REST response content executed as script in the browser of a user who visits the cached REST URL. Exploitation requires this non-default configuration.
References
- https://wpsec.com/vuln/WPSEC-2026-1410/
- https://plugins.svn.wordpress.org/w3-total-cache/tags/2.11.0/
- https://wordpress.org/plugins/w3-total-cache/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS