CVE-2026-78438

CVE-2026-78438 is a stored cross-site scripting vulnerability in the W3 Total Cache WordPress plugin, affecting all versions up to and including 2.10.5, caused by insufficient input sanitization and output escaping of comment content processed by the LazyLoad Background Mutator. An unauthenticated attacker submits a WordPress comment containing arbitrary web script; once a moderator approves the comment, the injected script executes in the browser of any user who views that page, provided the site has the 'Lazy Load Images' feature with the 'Process background images' option enabled. Successful exploitation allows the attacker to run arbitrary JavaScript in the context of the affected site, enabling actions such as session hijacking, redirecting visitors, or performing administrative actions if an administrator views the infected page. Any WordPress site running W3 Total Cache 2.10.5 or earlier with background-image lazy loading enabled and comment submission open is affected. No public proof-of-concept or confirmed in-the-wild exploitation is currently known; EPSS estimates roughly a 0.3% probability of exploitation within 30 days, and the flaw is not in CISA KEV.

What to do: Update W3 Total Cache to the first release after 2.10.5 as soon as a patched version is published, since 2.10.5 and all earlier versions are vulnerable. As an interim mitigation, disable the 'Process background images' option under Lazy Load Images, or tighten comment moderation and reject comments containing HTML or script markup. Review already-approved comments for injected code, because any existing malicious comment will execute for every visitor viewing that page.