WT
Product
W3 Total Cache
23
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 3High 12Medium 6Low 0
Watch
Add W3 Total Cache to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-12365 | 8.5 | Jan 14 | W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery Affected: through 2.8.1 |
| CVE-2026-9282 | 7.5 | Jul 11 | W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter Affected: through 2.9.4 |
| CVE-2026-5032 | 7.5 | Apr 2 | W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header Affected: through 2.9.3 |
| CVE-2024-12008 | 7.5 | Jan 14 | W3 Total Cache <= 2.8.1 Information Exposure via Log Files Affected: through 2.8.1 |
| CVE-2023-5359 | 7.5 | Sep 24 | W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext Affected: through 2.7.5 |
| CVE-2012-6079 | 7.5 | Nov 22 | W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via their hash keys Affected: before 0.9.2.5 |
| CVE-2012-6078 | 7.5 | Nov 22 | W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes Affected: before 0.9.2.5 |
| CVE-2012-6077 | 7.5 | Nov 22 | W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files Affected: before 0.9.2.5 |
| CVE-2019-6715 | 7.5 | Apr 1 | pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON… Affected: before 0.9.4 |
| CVE-2026-87920 | 7.2 | Oct 2 | W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content Affected: through 2.10.6 |
| CVE-2026-78438 | 7.2 | Sep 5 | W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator Affected: through 2.10.5 |
| CVE-2026-18109 | 7.2 | Aug 14 | W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name Affected: through 2.10.3 |
Showing 12