The vulnerability is an improper neutralization of input during web page generation that allows stored cross‑site scripting attacks. Attackers can inject malicious scripts into content or configuration that is later rendered to other users, potentially stealing credentials, defacing the site or executing arbitrary actions. This weakness is cataloged as CWE‑79 and can compromise the integrity and confidentiality of users interacting with the affected site.

Bold Grid’s W3 Total Cache plugin for WordPress is affected. Versions from the earliest release through 2.10.7 are vulnerable. The latest patched release is 2.11.0. WordPress sites that have the plugin installed and in that version range are impacted.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this on any site that allows the plugin to accept input, such as cached content blocks or administrative settings. This stored XSS can be triggered whenever a user views the affected page, making it a high‑risk attack vector for sites with unsanitized user input.