CVE-2026-78438: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in boldgrid W3 Total Cache

CVE-2026-78438 is a stored cross-site scripting vulnerability in the W3 Total Cache WordPress plugin, affecting all versions up to and including 2.10.5. The flaw exists due to improper neutralization of input during web page generation, specifically in the LazyLoad Background Mutator feature when processing background images. An attacker can inject arbitrary scripts via comment content that execute when users access the affected pages. Exploitation requires the "Lazy Load Images" feature with "Process background images" enabled and moderator approval of the malicious comment. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 7.2 (high severity). No official patch or remediation guidance is currently documented.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to information disclosure or session hijacking. The attack requires that the malicious comment be approved by a moderator and that specific plugin features be enabled, limiting the attack surface. There is no indication of impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the "Lazy Load Images" feature or the "Process background images" option to mitigate the risk. Additionally, strict moderation of comments is advised to prevent approval of malicious content.