Unscored severity · published Dec 19, 2014
CVE-2014-8724
Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATH_INFO to the default URI.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WT
W3 Total Cache · Boldgrid
through 0.9.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8724
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8724
Exploit
http://packetstormsecurity.com/files/129626/W3-Total-Cache-0.9.4-Cross-Site-Scripting.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/534266/100/0/threaded
Vendor Advisory
https://wordpress.org/plugins/w3-total-cache/changelog/
Exploit
https://www.secuvera.de/advisories/secuvera-SA-2014-01.txt
More from W3 Total Cache
9.8
CVE-2013-2010
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability
9.0
CVE-2026-57623
WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability
9.0
CVE-2026-27384
WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability
8.5
CVE-2024-12365
W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery
7.5
CVE-2026-9282
W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter