The W3 Total Cache plugin contains a stored cross‑site scripting flaw that arises when user content submitted through the comment form is cached as HTML after a Pro license expires. Because the plugin fails to sanitize the comment field and does not escape the output before storing it in disk‑based page cache, an attacker can persist arbitrary JavaScript. When any visitor loads the affected page, the embedded script runs with the privileges of that page, enabling data exfiltration or session hijacking. This injection is a classic stored XSS vulnerability (CWE‑79).

The flaw affects every installation of the W3 Total Cache WordPress plugin with a version number of 2.10.7 or earlier. It requires that the site had previously enabled REST caching under a Pro license, that license has subsequently expired or been removed, and that Disk Enhanced page caching remains active. The vulnerability is therefore limited to sites using the Pro edition and retaining the enhanced caching option, though the patched fix applies to all affected releases.

The overall CVSS score is 7.2, classifying it as high severity, but the EPSS score is unavailable, making it difficult to gauge current exploitation probability. The vulnerability can be exploited by any unauthenticated commenter who has been granted an approved commenter identity via the plugin’s moderation workflow. Once injected data is cached, every subsequent visitor to the affected page will execute the script, amplifying the impact. Because the attack does not require privileged credentials and only relies on a cached comment entry, the risk is significant for any site that satisfies the prerequisite conditions. The vulnerability is not yet listed in CISA’s KEV catalog, so there is no known mass exploitation but that may change as the flaw becomes publicly known.