Security Alert Summary
The W3 Total Cache plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the handling of the comment parameter in versions up to and including 2.10.7. The issue arises when HTML Minify is enabled with the default mfunc entry present in the ignored-comment stems list, and exploitation requires an attacker to predict the md5(time()) placeholder namespace by reading the server clock via the HTTP Date response header within a limited time window.
CVE Details
- CVE ID: CVE-2026-120019
- Affected component: W3 Total Cache plugin for WordPress
- Affected versions: All versions up to and including 2.10.7
- Published: October 31, 2026 at 7:16:37 AM UTC
- Last modified: October 31, 2026 at 7:16:37 AM UTC
- CVSS v3.1: Base Score 5.4, MEDIUM — Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Authentication / Privileges / User interaction: Authentication: None required; Privileges required: None; User interaction: None
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
This vulnerability is a stored cross-site scripting (XSS) issue caused by insufficient input sanitization and output escaping for the comment parameter. When HTML Minify is enabled and the default mfunc entry is present in the ignored-comment stems list, user-supplied content can be retained and later rendered in pages without the necessary neutralization.
Exploitation requires the attacker to predict the temporary namespace used by the plugin for preserved comments, which depends on a md5(time()) placeholder value generated from the server clock. An attacker can attempt to read the server time via the HTTP Date response header and use that information within the applicable time window to construct the expected placeholder namespace and store script payloads that will be executed when a victim views the affected page.
The vulnerability is referenced in the plugin codebase around Minify_Plugin.php and the IgnoredCommentPreserver implementation in the Minify library, as indicated in the supplied references. The root cause is missing or insufficient sanitization and escaping of preserved comment content when the ignored-comment stems behavior is active.
Impact is limited to the ability to inject and execute script in the context of pages where the injected comment is preserved and rendered. It does not, based on the provided data, indicate escalation beyond script execution in affected pages.
How This Could Impact Your Website
Consider a small team managing a WordPress site: a site owner, internal content editors, and an external contractor who occasionally posts content. If HTML Minify is enabled with the default ignored-comment stems configuration, an unauthenticated attacker could inject a script payload via the comment parameter that is stored and later executed when an editor or visitor loads the affected page.
Practical consequences include exposure of data accessible in the page context (for example, user-visible information such as names or email addresses shown on the page), and an increased risk of targeted phishing or social engineering if attackers use injected scripts to harvest visible contact information or perform UI-based attacks. These impacts align with the CVSS confidentiality and integrity impacts rated as Low.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other roles that allow content submission.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Disable HTML Minify or adjust Minify ignored-comment settings if you cannot immediately update, and review any custom Minify configurations that preserve comments.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, including unexpected comment content or changes to cached/minified output.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/BoldGrid/w3-total-cache/commit/35c6896332aff6b41888db0595cf09b4c98c814c
- https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.7/Minify_Plugin.php#L625
- https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.7/lib/Minify/Minify/IgnoredCommentPreserver.php#L10
- https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.7/lib/Minify/Minify/IgnoredCommentPreserver.php#L25
- https://plugins.trac.wordpress.org/changeset/3757452/w3-total-cache/trunk/lib/Minify/Minify/IgnoredCommentPreserver.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3a14a537-64e7-415b-be8e-a3a9377fd20d?source=cve
Disclosures
Source: security@wordfence.com
