WT
Product
W3 Total Cache
23
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 3High 12Medium 6Low 0
Watch
Add W3 Total Cache to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-2010 | 9.8 | Feb 12 | WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability Affected: through 0.9.2.8 |
| CVE-2026-57623 | 9.0 | Jul 2 | WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability Affected: through 2.9.4 |
| CVE-2026-27384 | 9.0 | Mar 5 | WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability Affected: through 2.9.1 |
| CVE-2024-12365 | 8.5 | Jan 14 | W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery Affected: through 2.8.1 |
| CVE-2026-9282 | 7.5 | Jul 11 | W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter Affected: through 2.9.4 |
| CVE-2026-5032 | 7.5 | Apr 2 | W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header Affected: through 2.9.3 |
| CVE-2024-12008 | 7.5 | Jan 14 | W3 Total Cache <= 2.8.1 Information Exposure via Log Files Affected: through 2.8.1 |
| CVE-2023-5359 | 7.5 | Sep 24 | W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext Affected: through 2.7.5 |
| CVE-2012-6079 | 7.5 | Nov 22 | W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via their hash keys Affected: before 0.9.2.5 |
| CVE-2012-6078 | 7.5 | Nov 22 | W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes Affected: before 0.9.2.5 |
| CVE-2012-6077 | 7.5 | Nov 22 | W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files Affected: before 0.9.2.5 |
| CVE-2019-6715 | 7.5 | Apr 1 | pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON… Affected: before 0.9.4 |
| CVE-2026-87920 | 7.2 | Oct 2 | W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content Affected: through 2.10.6 |
| CVE-2026-78438 | 7.2 | Sep 5 | W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator Affected: through 2.10.5 |
| CVE-2026-18109 | 7.2 | Aug 14 | W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name Affected: through 2.10.3 |
| CVE-2026-66695 | 6.5 | Aug 6 | WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability Affected: through 2.10.2 |
| CVE-2021-24452 | 6.1 | Jul 19 | The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when… Affected: before 2.1.5 |
| CVE-2021-24436 | 6.1 | Jul 19 | The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions… Affected: before 2.1.4 |
| CVE-2024-12006 | 5.3 | Jan 14 | W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation Affected: through 2.8.1 |
| CVE-2021-24427 | 4.8 | Jul 12 | The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output… Affected: before 2.1.3 |
| CVE-2026-39595 | 4.7 | Jun 17 | WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability Affected: through 2.9.1 |
| CVE-2014-9414 | – | Dec 24 | The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks… Affected: through 0.9.4 |
| CVE-2014-8724 | – | Dec 19 | Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web… Affected: through 0.9.4 |
Showing 23