CVE-2026-87920 boldgrid CVE debrief

Who should care

Defenders responsible for WordPress installations with the W3 Total Cache plugin should assess exposure and prioritize remediation. This includes verifying if the 'Remove query strings from static resources' option is enabled and taking appropriate actions to mitigate the vulnerability. Security teams should review the CVE record and NVD entry for additional details and guidance.

Why it matters

Defenders should care about CVE-2026-87920 because it allows unauthenticated attackers to inject arbitrary web scripts in pages, potentially leading to script execution when users access injected pages. The vulnerability requires verification of the 'Remove query strings from static resources' option in W3 Total Cache and affects versions up to 2.10.6.

• Potential injection of arbitrary web scripts
• Possible execution of scripts when a user accesses an injected page
• Verification of 'Remove query strings from static resources' option
• Remediation priority for affected versions

Technical summary

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability requires the 'Remove query strings from static resources' option to be enabled in W3 Total Cache, affecting versions up to 2.10.6. Defenders should prioritize verifying if this option is enabled and assess exposure.

Defensive priority

Defenders should prioritize verifying if the 'Remove query strings from static resources' option is enabled in W3 Total Cache and assess exposure.

Recommended defensive actions

• Verify if the 'Remove query strings from static resources' option is enabled in W3 Total Cache
• Assess exposure and prioritize remediation
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The vulnerability exists in all versions up to, and including, 2.10.6 of the W3 Total Cache plugin. The CVE record and NVD entry provide details on the vulnerability. Evidence is limited to public sources and may not be comprehensive. Defenders should verify the 'Remove query strings from static resources' option and assess exposure. Additional verification may be necessary to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.