W3 Total Cache

Software Type	Plugin
Software Slug	w3-total-cache (view on wordpress.org)
Software Status	Active
Software Author	boldgrid
Software Website	www.boldgrid.com
Software Downloads	66,993,573
Software Active Installs	900,000
Software Record Last Updated	October 6, 2026

Showing 1-20 of 37 Vulnerabilities

Submit a Vulnerability

W3 Total Cache <= 2.9.1 - Unauthenticated Arbitrary Code Execution

9.8

CVE-2026-27384

Feb 24, 2026

Researcher: CODE WHITE GmbH

W3 Total Cache <= 0.9.2.8 - Remote Code Execution

9.8

CVE-2013-2010

Aug 1, 2014

Researchers: H D Moore, Christian Mehlmauer, juan vazquez, temp66

W3 Total Cache <= 0.9.4.1 - Arbitrary File Upload

8.8

CVE ID Unknown

Sep 26, 2016

Researcher: SecuPress

W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting

8.8

CVE ID Unknown

Sep 8, 2014

Researcher: Voxel@Night

W3 Total Cache <= 0.9.4 - Server-Side Request Forgery leading to Host Information Disclosure

8.6

CVE ID Unknown

Oct 31, 2016

Researcher: Jouko Pynnöne

W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery

8.5

CVE-2024-12365

Jan 13, 2025

Researcher: villu164

W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary Code Execution

8.1

CVE-2026-57623

Jun 29, 2026

Researcher: Ananda Dhakal

W3 Total Cache <= 2.8.12 - Unauthenticated Command Injection

8.1

CVE-2025-9501

Oct 27, 2025

Researcher: wesley (wcraft)

Guzzle <= 6.5.7 and 7.0-7.4.4 - Information Exposure

7.7

CVE-2022-31090

Jun 20, 2022

Researchers:

W3 Total Cache < 2.10.5 - Unauthenticated Path Traversal

7.5

CVE-2026-18051

Aug 21, 2026

Researcher: Jakub Herman

W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter

7.5

CVE-2026-9282

Jul 10, 2026

Researcher: snr

W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header

7.5

CVE-2026-5032

Apr 1, 2026

Researcher: wesley (wcraft)

W3 Total Cache 0.9.2.6-0.9.3 - File Read / Directory Traversal

7.5

CVE-2019-6715

Dec 22, 2020

Researchers:

W3 Total Cache <= 0.9.2.4 - Insecure Cryptography to Sensitive Information Disclosure

7.5

CVE-2012-6078

Sep 22, 2020

Researchers:

W3 Total Cache <= 0.9.2.4 - Password Hash Extraction

7.5

CVE-2012-6077

Sep 22, 2020

Researchers:

W3 Total Cache <= 0.9.2.4 - Sensitive Information Exposure

7.5

CVE-2012-6079

Sep 22, 2020

Researchers:

W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content

7.2

CVE-2026-87920

Oct 1, 2026

Researcher: theviper17y

W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator

7.2

CVE-2026-78438

Sep 4, 2026

Researcher: theviper17y

W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

7.2

CVE-2026-18109

Aug 13, 2026

Researcher: daroo

W3 Total Cache <= 2.1.4 - Reflected Cross-Site Scripting via extension

7.2

CVE-2021-24452

Jun 28, 2021

Researchers:

Title	Status	CVE ID	CVSS	Researchers	Date
W3 Total Cache <= 2.9.1 - Unauthenticated Arbitrary Code Execution	Patched	CVE-2026-27384	9.8	CODE WHITE GmbH	February 24, 2026
W3 Total Cache <= 0.9.2.8 - Remote Code Execution	Patched	CVE-2013-2010	9.8	H D Moore, Christian Mehlmauer, juan vazquez, temp66	August 1, 2014
W3 Total Cache <= 0.9.4.1 - Arbitrary File Upload	Patched		8.8	SecuPress	September 26, 2016
W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting	Patched		8.8	Voxel@Night	September 8, 2014
W3 Total Cache <= 0.9.4 - Server-Side Request Forgery leading to Host Information Disclosure	Patched		8.6	Jouko Pynnöne	October 31, 2016
W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery	Patched	CVE-2024-12365	8.5	villu164	January 13, 2025
W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary Code Execution	Patched	CVE-2026-57623	8.1	Ananda Dhakal	June 29, 2026
W3 Total Cache <= 2.8.12 - Unauthenticated Command Injection	Patched	CVE-2025-9501	8.1	wesley (wcraft)	October 27, 2025
Guzzle <= 6.5.7 and 7.0-7.4.4 - Information Exposure	Patched	CVE-2022-31090	7.7		June 20, 2022
W3 Total Cache < 2.10.5 - Unauthenticated Path Traversal	Patched	CVE-2026-18051	7.5	Jakub Herman	August 21, 2026
W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter	Patched	CVE-2026-9282	7.5	snr	July 10, 2026
W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header	Patched	CVE-2026-5032	7.5	wesley (wcraft)	April 1, 2026
W3 Total Cache 0.9.2.6-0.9.3 - File Read / Directory Traversal	Patched	CVE-2019-6715	7.5		December 22, 2020
W3 Total Cache <= 0.9.2.4 - Insecure Cryptography to Sensitive Information Disclosure	Patched	CVE-2012-6078	7.5		September 22, 2020
W3 Total Cache <= 0.9.2.4 - Password Hash Extraction	Patched	CVE-2012-6077	7.5		September 22, 2020
W3 Total Cache <= 0.9.2.4 - Sensitive Information Exposure	Patched	CVE-2012-6079	7.5		September 22, 2020
W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content	Patched	CVE-2026-87920	7.2	theviper17y	October 1, 2026
W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator	Patched	CVE-2026-78438	7.2	theviper17y	September 4, 2026
W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name	Patched	CVE-2026-18109	7.2	daroo	August 13, 2026
W3 Total Cache <= 2.1.4 - Reflected Cross-Site Scripting via extension	Patched	CVE-2021-24452	7.2		June 28, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation