A vulnerability has been discovered on the WordPress plugin w3 total cache that allows cross site scripting XSS code to be remotely executed on a WordPress based website.
As seen in the YouTube video above, it has been tested on a live website. It worked on version 0.9.2 and earlier
Update your w3 Total Cache plugin to at least version 0.9.3.
Always keep all your plugins up to date