Threats tagged 'ghsa-9wg2-5m8p-rghq'

The W3 Total Cache plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter affecting all versions up to and including 2.10.7. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires that a Pro license was previously active with REST caching enabled but is now inactive while Disk Enhanced page caching remains configured, and that the attacker has a previously approved commenter identity.