CVE-2026-78438W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator Exploitation status Not known exploited Fix Affected product W W3 Total Cache Published 09/05/2026 Severity High CVE-2026-18109W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name Exploitation status Not known exploited Fix Affected product W W3 Total Cache Published 08/14/2026 Severity High CVE-2026-66708WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product T Total Upkeep Published 08/06/2026 Severity High CVE-2026-66695WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability Exploitation status Not known exploited Fix Affected product W W3 Total Cache Published 08/06/2026 Severity Medium CVE-2026-57428WordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product S Sprout Clients Published 07/23/2026 Severity High CVE-2026-57418WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product C Client Invoicing by Sprout Invoices Published 07/13/2026 Severity Medium CVE-2026-9282W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter Exploitation status Not known exploited Fix Affected product W W3 Total Cache Published 07/11/2026 Severity High CVE-2026-57623WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability Exploitation status Not known exploited Fix Affected product W W3 Total Cache Published 07/02/2026 Severity Critical CVE-2026-39595WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W W3 Total Cache Published 06/17/2026 Severity Medium CVE-2026-3143Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation Exploitation status Not known exploited Fix Affected product T Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Published 05/01/2026 Severity Medium CVE-2026-39562WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.10 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product C Client Invoicing by Sprout Invoices Published 04/08/2026 Severity Medium CVE-2026-5032W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header Exploitation status Not known exploited Fix Affected product W W3 Total Cache Published 04/02/2026 Severity High CVE-2026-32484WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product W weForms Published 03/25/2026 Severity High CVE-2026-32424WordPress Sprout Clients plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product S Sprout Clients Published 03/13/2026 Severity Medium CVE-2026-32401WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product C Client Invoicing by Sprout Invoices Published 03/13/2026 Severity High CVE-2026-2707weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API Exploitation status Not known exploited Fix Affected product W weForms – Easy Drag & Drop Contact Form Builder For WordPress Published 03/11/2026 Severity Medium CVE-2026-27384WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability Exploitation status Not known exploited Fix Affected product W W3 Total Cache Published 03/05/2026 Severity Critical CVE-2026-25364WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product C Client Invoicing by Sprout Invoices Published 02/19/2026 Severity Medium CVE-2025-69345WordPress Post and Page Builder by BoldGrid plugin <= 1.27.9 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product P Post and Page Builder by BoldGrid Published 01/06/2026 Severity Medium CVE-2025-69028WordPress weForms plugin <= 1.6.25 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W weForms Published 12/30/2025 Severity Medium CVE-2025-66118WordPress Sprout Clients plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product S Sprout Clients Published 12/18/2025 Severity High CVE-2025-64227WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product C Client Invoicing by Sprout Invoices Published 12/18/2025 Severity Critical CVE-2025-64229WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product C Client Invoicing by Sprout Invoices Published 10/29/2025 Severity Medium CVE-2025-52712WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.8 - Path Traversal Vulnerability Exploitation status Not known exploited Fix Affected product P Post and Page Builder by BoldGrid Published 08/14/2025 Severity Medium CVE-2020-36848Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download Exploitation status Not known exploited Fix Affected product T Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Published 07/12/2025 Severity High CVE-2025-52713WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Server Side Request Forgery (SSRF) Vulnerability Exploitation status Not known exploited Fix Affected product P Post and Page Builder by BoldGrid Published 06/20/2025 Severity Medium CVE-2025-52711WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Cross Site Request Forgery (CSRF) Vulnerability Exploitation status Not known exploited Fix Affected product P Post and Page Builder by BoldGrid Published 06/20/2025 Severity Medium CVE-2025-31797WordPress Sprout Clients plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product S Sprout Clients Published 04/01/2025 Severity Medium CVE-2025-2257Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection Exploitation status Not known exploited Fix Affected product T Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Published 03/26/2025 Severity High CVE-2024-13907Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.8 - Authenticated (Administrator+) Server-Side Request Forgery Exploitation status Not known exploited Fix Affected product T Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Published 02/27/2025 Severity Medium CVE-2025-0859Post and Page Builder by BoldGrid <= 1.27.6 - Path Traversal to Authenticated (Contributor+) Arbitrary File Read via template_via_url Function Exploitation status Not known exploited Fix Affected product P Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Published 02/06/2025 Severity Medium CVE-2025-24606WordPress Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress plugin <=20.8.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product C Client Invoicing by Sprout Invoices Published 01/27/2025 Severity Medium CVE-2025-22759WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product P Post and Page Builder by BoldGrid Published 01/15/2025 Severity Medium CVE-2024-12008W3 Total Cache <= 2.8.1 Information Exposure via Log Files Exploitation status Not known exploited Fix Affected product W W3 Total Cache Published 01/14/2025 Severity Medium CVE-2024-12006W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation Exploitation status Not known exploited Fix Affected product W W3 Total Cache Published 01/14/2025 Severity Medium CVE-2024-12365W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery Exploitation status Not known exploited Fix Affected product W W3 Total Cache Published 01/14/2025 Severity High CVE-2025-22512WordPress Help Scout Plugin <= 6.5.6 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product H Help Scout Published 01/07/2025 Severity Medium CVE-2024-53819WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.0 - Insecure Direct Object References (IDOR) vulnerability Exploitation status Not known exploited Fix Affected product C Client Invoicing by Sprout Invoices Published 12/09/2024 Severity Medium CVE-2024-9461Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings Exploitation status Not known exploited Fix Affected product T Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Published 11/26/2024 Severity High CVE-2023-5359W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext Exploitation status Not known exploited Fix Affected product W W3 Total Cache Published 09/24/2024 Severity Low CVE-2024-6848Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Upload Exploitation status Not known exploited Fix Affected product P Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Published 07/20/2024 Severity Medium CVE-2024-24869WordPress Total Upkeep plugin <= 1.15.8 - Arbitrary File Download vulnerability Exploitation status Not known exploited Fix Affected product T Total Upkeep Published 05/17/2024 Severity High CVE-2024-4400Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.4 - Authenticated (Contributer+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product P Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Published 05/16/2024 Severity Medium CVE-2024-2950BoldGrid Easy SEO – Simple and Effective SEO <= 1.6.14 - Information Exposure Exploitation status Not known exploited Fix Affected product B BoldGrid Easy SEO – Simple and Effective SEO Published 04/06/2024 Severity Medium CVE-2024-1692BoldGrid Easy SEO – Simple and Effective SEO <= 1.6.13 - Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Description Exploitation status Not known exploited Fix Affected product B BoldGrid Easy SEO – Simple and Effective SEO Published 03/30/2024 Severity Medium CVE-2024-2888WordPress Post and Page Builder by BoldGrid plugin <= 1.26.2 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product P Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Published 03/26/2024 Severity Medium CVE-2024-0386weForms <= 1.6.21 - Unauthenticated Stored Cross-Site Scripting via Referer Exploitation status Not known exploited Fix Affected product W weForms – Easy Drag & Drop Contact Form Builder For WordPress Published 03/12/2024 Severity High CVE-2023-25480WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin <= 1.24.1 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product P Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Published 10/06/2023 Severity Medium CVE-2022-4932Total Upkeep <= 1.14.13 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure Exploitation status Not known exploited Fix Affected product T Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Published 03/07/2023 Severity Medium CVE-2021-24452W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context) Exploitation status Not confirmed Fix Affected product W W3 Total Cache Published 07/19/2021 Severity Unknown CVE-2021-24436W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context) Exploitation status Not confirmed Fix Affected product W W3 Total Cache Published 07/19/2021 Severity Unknown CVE-2021-24427W3 Total Cache < 2.1.3 - Authenticated Stored XSS Exploitation status Not confirmed Fix Affected product W W3 Total Cache Published 07/12/2021 Severity Unknown CVE-2013-2010Exploitation status Not confirmed Fix Not confirmed Affected product W W3 Total Cache Plugin Published 02/12/2020 Severity Unknown CVE-2012-6079Exploitation status Not confirmed Fix Not confirmed Affected product T Total Cache Published 11/22/2019 Severity Unknown CVE-2012-6078Exploitation status Not confirmed Fix Not confirmed Affected product T Total Cache Published 11/22/2019 Severity Unknown CVE-2012-6077Exploitation status Not confirmed Fix Not confirmed Affected product T Total Cache Published 11/22/2019 Severity Unknown CVE-2019-6715Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 04/01/2019 Severity Unknown CVE-2014-9414Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 12/24/2014 Severity Unknown CVE-2014-8724Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 12/19/2014 Severity Unknown 
