{
 "id": "WPSEC-2026-1410",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1410/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1410/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1410/index.md",
 "title": "W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Cached REST API Responses",
 "description": "The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cached REST API responses in all versions up to, and including, 2.10.7. When the REST cache mode was left set to 'cache' without Pro active and Page Cache used Disk: Enhanced, REST JSON responses were stored as '.html' static files with no nosniff header, so the web server served them as text/html. This makes it possible for unauthenticated attackers to get markup contained in REST response content executed as script in the browser of a user who visits the cached REST URL. Exploitation requires this non-default configuration.",
 "plugin": {
  "slug": "w3-total-cache",
  "name": "W3 Total Cache",
  "full_name": "W3 Total Cache",
  "wordpress_org": "https://wordpress.org/plugins/w3-total-cache/",
  "advisories_url": "https://wpsec.com/vuln/plugin/w3-total-cache/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/w3-total-cache"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.11.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.11.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.11.0",
 "remediation": "Update to 2.11.0 or later.",
 "fix_released": "2026-10-20T20:36:47+00:00",
 "published": "2026-10-21T20:43:15+00:00",
 "updated": "2026-10-21T12:33:09.908762+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1410/",
  "https://plugins.svn.wordpress.org/w3-total-cache/tags/2.11.0/",
  "https://wordpress.org/plugins/w3-total-cache/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/w3-total-cache",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-21"
 }
}