CVE-2026-18109 is a stored cross-site scripting vulnerability in the W3 Total Cache WordPress plugin affecting all versions up to 2.10.3. The flaw is due to improper neutralization of input in the Comment Author Name field, which is not properly sanitized or escaped before being re-emitted in the page. This vulnerability is exploitable only when the Lazy Load Images feature is enabled, as the unsafe output occurs exclusively during the LazyLoad mutator's img tag rewriting step. An unauthenticated attacker can inject malicious scripts that execute in the context of users visiting the affected pages.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of users visiting pages with injected comments, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability has a CVSS 3.1 base score of 7.2 (High), indicating significant impact on confidentiality and integrity but no impact on availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable the Lazy Load Images feature in W3 Total Cache to prevent exploitation. Monitor vendor channels for updates and apply official patches once available.