W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-87920 · Microsoft / collected KEV context

cve-program · CVE-2026-87920

• https://www.wordfence.com/threat-intel/vulnerabilities/id/34bd7c32-f4c5-4015-909a-e4730f35494b?source=cve
• https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.6/BrowserCache_Plugin.php#L259
• https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.6/BrowserCache_Plugin.php#L208
• https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.6/BrowserCache_Plugin.php#L336
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3723494%40w3-total-cache%2Ftags%2F2.10.7&old=3681561%40w3-total-cache%2Ftags%2F2.10.6
• https://plugins.trac.wordpress.org/changeset/3723494/w3-total-cache/trunk/BrowserCache_Plugin.php

No related operational record is retained in the current change model.