W3 Total Cache
- Software type
- WordPress plugin
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, W3 Total Cache recorded 5 security vulnerabilities in the last 90 days, of which 4 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of W3 Total Cache and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-120019W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify PlaceholderCVE-2026-111254W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License ExpiryCVE-2026-87920W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment ContentCVE-2026-78438W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background MutatorCVE-2026-18109W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-120019W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-111254W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry | Exploitation statusNot exploited | FixYes | Published10/31/2026 | SeverityHigh |
|---|
CVE-2026-87920W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-78438W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator | Exploitation statusNot exploited | FixYes | Published09/05/2026 | SeverityHigh |
|---|
CVE-2026-18109W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name | Exploitation statusNot exploited | FixYes | Published08/14/2026 | SeverityHigh |
|---|
CVE-2026-66695Unauthenticated path traversal in BoldGrid W3 Total Cache enables unintended path access | Exploitation statusNot exploited | FixYes | Published08/06/2026 | SeverityMedium |
|---|
CVE-2026-9282W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter | Exploitation statusNot exploited | FixYes | Published07/11/2026 | SeverityHigh |
|---|
CVE-2026-57623WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability | Exploitation statusNot exploited | FixYes | Published07/02/2026 | SeverityCritical |
|---|
CVE-2026-39595WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Published06/17/2026 | SeverityMedium |
|---|
CVE-2026-5032W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header | Exploitation statusNot exploited | FixYes | Published04/02/2026 | SeverityHigh |
|---|
CVE-2026-27384WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability | Exploitation statusNot exploited | FixYes | Published03/05/2026 | SeverityCritical |
|---|
CVE-2024-12365W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery | Exploitation statusNot exploited | FixYes | Published01/14/2025 | SeverityHigh |
|---|
CVE-2024-12008W3 Total Cache <= 2.8.1 Information Exposure via Log Files | Exploitation statusNot exploited | FixYes | Published01/14/2025 | SeverityMedium |
|---|
CVE-2024-12006W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation | Exploitation statusNot exploited | FixYes | Published01/14/2025 | SeverityMedium |
|---|
CVE-2023-5359W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext | Exploitation statusNot exploited | FixYes | Published09/24/2024 | SeverityLow |
|---|
CVE-2021-24452W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context) | Exploitation statusNot confirmed | FixYes | Published07/19/2021 | SeverityUnknown |
|---|
CVE-2021-24436W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context) | Exploitation statusNot confirmed | FixYes | Published07/19/2021 | SeverityUnknown |
|---|
CVE-2021-24427W3 Total Cache < 2.1.3 - Authenticated Stored XSS | Exploitation statusNot confirmed | FixYes | Published07/12/2021 | SeverityUnknown |
|---|
18 Results | Page 1 of 1