CVE-2026-87920 Overview
CVE-2026-87920 is a Stored Cross-Site Scripting (XSS) vulnerability in the W3 Total Cache plugin for WordPress, affecting all versions up to and including 2.10.6. The flaw stems from insufficient input sanitization and output escaping in the plugin's output-buffer regex rewrite logic within BrowserCache_Plugin.php. Unauthenticated attackers can inject arbitrary scripts via comment content that execute when a visitor loads an affected page. Exploitation requires the Remove query strings from static resources option to be enabled, because the mutate_url() routine strips the ? delimiter and trailing characters, breaking the HTML attribute boundary. The vulnerability is tracked under [CWE-79].
Critical Impact
Unauthenticated attackers can store malicious JavaScript via comment content, enabling session theft, administrative action hijacking, and site-wide defacement on vulnerable WordPress installations.
Affected Products
- WordPress W3 Total Cache plugin versions through 2.10.6
- Installations with Remove query strings from static resources enabled
- Fixed in W3 Total Cache version 2.10.7
Discovery Timeline
- 2026-10-02 - CVE-2026-87920 published to NVD
- 2026-10-03 - Last updated in NVD database
Technical Details for CVE-2026-87920
Vulnerability Analysis
The W3 Total Cache plugin rewrites static resource URLs through an output-buffer filter. The mutate_url() function in BrowserCache_Plugin.php strips query strings when the corresponding option is enabled. Attacker-controlled comment content containing crafted URL-like substrings reaches this rewrite path without sufficient escaping. When the function removes the ? delimiter and trailing characters, it also strips the closing quote of the enclosing HTML attribute. The resulting markup breaks out of the attribute boundary and injects attacker-controlled script into the rendered page.
Because the payload is persisted as a comment, every subsequent visitor to the affected post executes the injected JavaScript in the browser context of the WordPress site. Scope changes from the vulnerable component to the user's browser, which explains the cross-boundary impact.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The regex-based URL rewrite inside the output buffer does not validate that the matched substring resides inside a safe context before mutating it. Removing the ? and subsequent characters destroys the attribute delimiter, which the browser then parses as new markup.
Attack Vector
An unauthenticated attacker submits a comment containing a crafted URL that, after mutate_url() processes it, collapses the surrounding attribute quote. When the cached page is served, the browser interprets the broken attribute as a new tag or event handler and executes the attacker's script. See the Wordfence Vulnerability Report and the vulnerable code at BrowserCache_Plugin.php Line 208 for technical specifics.
Detection Methods for CVE-2026-87920
Indicators of Compromise
- Unexpected <script> tags or inline event handlers (for example onerror=, onload=) rendered inside cached HTML pages containing comments.
- Comment records in wp_comments containing URL-like strings with embedded quotes, angle brackets, or JavaScript keywords.
- Outbound requests from site visitors to unknown third-party domains originating from pages that host user comments.
Detection Strategies
- Inspect the rendered output of pages with comments for broken HTML attributes or unexpected script execution after enabling the Remove query strings from static resources option.
- Audit the W3 Total Cache configuration to identify sites where the vulnerable option is enabled on 2.10.6 or earlier.
- Review web server logs for comment submissions containing suspicious URL payloads targeting attribute-breakout patterns.
Monitoring Recommendations
- Monitor file integrity on BrowserCache_Plugin.php and verify the installed plugin version matches 2.10.7 or later.
- Alert on anomalous JavaScript execution reported via browser-side Content Security Policy (CSP) violation reports.
- Correlate comment creation events with subsequent page view spikes to identify stored-XSS exploitation patterns.
How to Mitigate CVE-2026-87920
Immediate Actions Required
- Upgrade W3 Total Cache to version 2.10.7 or later across all WordPress installations.
- If immediate patching is not possible, disable the Remove query strings from static resources option in W3 Total Cache settings.
- Purge all existing page caches to remove any pre-rendered pages containing injected scripts.
- Review the wp_comments table for suspicious entries submitted before patching.
Patch Information
The vendor fix is applied in W3 Total Cache Changeset 3723494. The diff between the vulnerable and patched releases is available in the Changeset Comparison. Administrators should update the plugin through the WordPress plugin dashboard or via WP-CLI.
Workarounds
- Disable the Remove query strings from static resources option until the plugin is updated to 2.10.7.
- Enforce comment moderation so unauthenticated submissions are reviewed before publication.
- Deploy a web application firewall (WAF) rule to block comment payloads containing attribute-breakout patterns in URLs.
# Update W3 Total Cache via WP-CLI
wp plugin update w3-total-cache --version=2.10.7
# Verify installed version
wp plugin get w3-total-cache --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
