W3 Total Cache

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   W3 Total Cache

Information

Software Type Plugin
Software Slug w3-total-cache (view on wordpress.org)
Software Status Active
Software Author boldgrid
Software Website www.boldgrid.com
Software Downloads 66,391,211
Software Active Installs 900,000
Software Record Last Updated September 6, 2026

Showing 1-20 of 36 Vulnerabilities

Submit a Vulnerability
W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator
7.2
CVE-2026-78438
Sep 4, 2026
Researcher: theviper17y
W3 Total Cache < 2.10.5 - Unauthenticated Path Traversal
7.5
CVE-2026-18051
Aug 21, 2026
Researcher: Jakub Herman
W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
7.2
CVE-2026-18109
Aug 13, 2026
Researcher: daroo
W3 Total Cache <= 2.10.2 - Unauthenticated Path Traversal
5.3
CVE-2026-66695
Jul 31, 2026
Researcher: Mykel Nelson
W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter
7.5
CVE-2026-9282
Jul 10, 2026
Researcher: snr
W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary Code Execution
8.1
CVE-2026-57623
Jun 29, 2026
Researcher: Ananda Dhakal
W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header
7.5
CVE-2026-5032
Apr 1, 2026
Researcher: wesley (wcraft)
W3 Total Cache <= 2.9.1 - Missing Authorization
4.3
CVE-2026-39595
Mar 12, 2026
Researcher: Muhammad Sharief
W3 Total Cache <= 2.9.1 - Unauthenticated Arbitrary Code Execution
9.8
CVE-2026-27384
Feb 24, 2026
Researcher: CODE WHITE GmbH
W3 Total Cache <= 2.8.12 - Unauthenticated Command Injection
8.1
CVE-2025-9501
Oct 27, 2025
Researcher: wesley (wcraft)
W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery
8.5
CVE-2024-12365
Jan 13, 2025
Researcher: villu164
W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation
5.3
CVE-2024-12006
Jan 13, 2025
Researcher: villu164
W3 Total Cache <= 2.8.1 Information Exposure via Log Files
5.3
CVE-2024-12008
Jan 13, 2025
Researcher: villu164
W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext
3.7
CVE-2023-5359
Sep 23, 2024
Researcher: Ivan Kuzymchak
Guzzle <= 6.5.7 and 7.0-7.4.4 - Information Exposure
7.7
CVE-2022-31090
Jun 20, 2022
Researchers:
W3 Total Cache <= 2.1.3 - Reflected Cross-Site Scripting via extension
6.1
CVE-2021-24436
Jun 28, 2021
Researcher: renniepak
W3 Total Cache <= 2.1.4 - Reflected Cross-Site Scripting via extension
7.2
CVE-2021-24452
Jun 28, 2021
Researchers:
W3 Total Cache <= 2.1.2 Authenticated (Admin+) Stored Cross-Site Scripting
4.8
CVE-2021-24427
Jun 16, 2021
Researcher: R3N0
W3 Total Cache 0.9.2.6-0.9.3 - File Read / Directory Traversal
7.5
CVE-2019-6715
Dec 22, 2020
Researchers:
W3 Total Cache <= 0.9.2.4 - Sensitive Information Exposure
7.5
CVE-2012-6079
Sep 22, 2020
Researchers:
Title Status CVE ID CVSS Researchers Date
W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator Patched CVE-2026-78438 7.2 theviper17y September 4, 2026
W3 Total Cache < 2.10.5 - Unauthenticated Path Traversal Patched CVE-2026-18051 7.5 Jakub Herman August 21, 2026
W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name Patched CVE-2026-18109 7.2 daroo August 13, 2026
W3 Total Cache <= 2.10.2 - Unauthenticated Path Traversal Patched CVE-2026-66695 5.3 Mykel Nelson July 31, 2026
W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter Patched CVE-2026-9282 7.5 snr July 10, 2026
W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary Code Execution Patched CVE-2026-57623 8.1 Ananda Dhakal June 29, 2026
W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header Patched CVE-2026-5032 7.5 wesley (wcraft) April 1, 2026
W3 Total Cache <= 2.9.1 - Missing Authorization Patched CVE-2026-39595 4.3 Muhammad Sharief March 12, 2026
W3 Total Cache <= 2.9.1 - Unauthenticated Arbitrary Code Execution Patched CVE-2026-27384 9.8 CODE WHITE GmbH February 24, 2026
W3 Total Cache <= 2.8.12 - Unauthenticated Command Injection Patched CVE-2025-9501 8.1 wesley (wcraft) October 27, 2025
W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery Patched CVE-2024-12365 8.5 villu164 January 13, 2025
W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation Patched CVE-2024-12006 5.3 villu164 January 13, 2025
W3 Total Cache <= 2.8.1 Information Exposure via Log Files Patched CVE-2024-12008 5.3 villu164 January 13, 2025
W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext Patched CVE-2023-5359 3.7 Ivan Kuzymchak September 23, 2024
Guzzle <= 6.5.7 and 7.0-7.4.4 - Information Exposure Patched CVE-2022-31090 7.7 June 20, 2022
W3 Total Cache <= 2.1.3 - Reflected Cross-Site Scripting via extension Patched CVE-2021-24436 6.1 renniepak June 28, 2021
W3 Total Cache <= 2.1.4 - Reflected Cross-Site Scripting via extension Patched CVE-2021-24452 7.2 June 28, 2021
W3 Total Cache <= 2.1.2 Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2021-24427 4.8 R3N0 June 16, 2021
W3 Total Cache 0.9.2.6-0.9.3 - File Read / Directory Traversal Patched CVE-2019-6715 7.5 December 22, 2020
W3 Total Cache <= 0.9.2.4 - Sensitive Information Exposure Patched CVE-2012-6079 7.5 September 22, 2020

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation