Attackers can inject malicious web scripts into pages of WordPress sites using the W3 Total Cache plugin, which then execute when a user accesses an injected…
Affected component: W3 Total Cache (plugin)
Fixed in: 2.11.0
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since November 1, 2026. No PowerSEC firewall rule blocks this attack. Update to 2.11.0 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-111254