# W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Cached REST API Responses

- **ID:** WPSEC-2026-1410
- **Plugin:** W3 Total Cache (`w3-total-cache`), https://wordpress.org/plugins/w3-total-cache/
- **Affected versions:** all versions before 2.11.0
- **Fixed in:** 2.11.0 (Update to 2.11.0 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/w3-total-cache
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1410/

## Description

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cached REST API responses in all versions up to, and including, 2.10.7. When the REST cache mode was left set to 'cache' without Pro active and Page Cache used Disk: Enhanced, REST JSON responses were stored as '.html' static files with no nosniff header, so the web server served them as text/html. This makes it possible for unauthenticated attackers to get markup contained in REST response content executed as script in the browser of a user who visits the cached REST URL. Exploitation requires this non-default configuration.

## References

- https://wpsec.com/vuln/WPSEC-2026-1410/
- https://plugins.svn.wordpress.org/w3-total-cache/tags/2.11.0/
- https://wordpress.org/plugins/w3-total-cache/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1410/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.