THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-78438 (HIGH 7.2) — The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthentic

[NVD] CVE-2026-78438 (HIGH 7.2) — The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthentic

mednvdPublished 2026-09-05

CVE-2026-78438 CVSS: 7.2 HIGH Published: 2026-09-05T07:17:12.580

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page

Indicators of compromise

CVE-2026-78438cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-78438