CVE-2026-87920 is a stored cross-site scripting vulnerability in the W3 Total Cache plugin for WordPress, affecting all versions up to and including 2.10.6. The vulnerability occurs due to insufficient sanitization and escaping of comment content during output-buffer regex rewriting, specifically when the 'Remove query strings from static resources' option is enabled. This option causes the mutate_url() function to strip the '?' delimiter and subsequent characters, including the closing quote of an HTML attribute, breaking the attribute boundary and allowing injection of arbitrary web scripts. The vulnerability allows unauthenticated attackers to inject scripts that execute in the context of users viewing the injected pages.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, leading to the execution of arbitrary scripts in the browsers of users who visit the affected pages. This can result in information disclosure and integrity impacts, such as theft of user credentials or session tokens. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with no availability impact.

No official patch or fix is currently documented in the provided data. Users should check the vendor advisory for updates. Until a fix is available, disabling the 'Remove query strings from static resources' option in W3 Total Cache will prevent exploitation by avoiding the URL mutation that enables the XSS injection. Monitoring vendor channels for an official patch or update is recommended.