Plugin icon

W3 Total Cache

w3-total-cache

Vulnerabilities:

25

Last Updated:

December 3, 2025

Active Installs:

1000000

Published
Title
Fixed in
CVSS
Published
2025-10-27
Title
W3 Total Cache < 2.8.13 - Unauthenticated Command Injection
Fixed in
Fixed in 2.8.13
CVSS
9.0 (critical)
Published
2025-01-13
Title
W3 Total Cache < 2.8.2 - Subscriber+ Server-Side Request Forgery
Fixed in
Fixed in 2.8.2
CVSS
7.7 (high)
Published
2025-01-13
Title
W3 Total Cache < 2.8.2 - Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation
Fixed in
Fixed in 2.8.2
CVSS
5.3 (medium)
Published
2025-01-13
Title
W3 Total Cache < 2.8.2 - Information Exposure via Log Files
Fixed in
Fixed in 2.8.2
CVSS
3.7 (low)
Published
2024-09-23
Title
W3 Total Cache < 2.7.6 - Sensitive Credentials Stored in Plaintext
Fixed in
Fixed in 2.7.6
CVSS
3.7 (low)
Published
2021-06-28
Title
W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)
Fixed in
Fixed in 2.1.4
CVSS
9.6 (critical)
Published
2021-06-28
Title
W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)
Fixed in
Fixed in 2.1.5
CVSS
8.2 (high)
Published
2021-06-16
Title
W3 Total Cache < 2.1.3 - Authenticated Stored XSS
Fixed in
Fixed in 2.1.3
CVSS
4.8 (medium)
Published
2019-05-06
Title
W3 Total Cache < 0.9.7.4 - Cryptographic Signature Bypass
Fixed in
Fixed in 0.9.7.4
CVSS
n/a
Published
2019-05-06
Title
W3 Total Cache < 0.9.7.4 - Blind SSRF and RCE via phar
Fixed in
Fixed in 0.9.7.4
CVSS
7.1 (high)
Published
2019-05-06
Title
W3 Total Cache <= 0.9.7.3 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 0.9.7.4
CVSS
n/a
Published
2016-11-10
Title
W3 Total Cache < 0.9.5 - Information Disclosure Race Condition
Fixed in
Fixed in 0.9.5
CVSS
n/a
Published
2016-11-10
Title
W3 Total Cache < 0.9.5 - Weak Validation of Amazon SNS Push Messages
Fixed in
Fixed in 0.9.5
CVSS
n/a
Published
2016-10-31
Title
W3 Total Cache <= 0.9.4 - Unauthenticated Server Side Request Forgery (SSRF)
Fixed in
Fixed in 0.9.5
CVSS
n/a
Published
2016-09-26
Title
W3 Total Cache < 0.9.5 – Authenticated Arbitrary File Upload
Fixed in
Fixed in 0.9.5
CVSS
n/a
Published
2016-09-26
Title
W3 Total Cache < 0.9.5 – Authenticated Arbitrary PHP Code Execution
Fixed in
Fixed in 0.9.5
CVSS
n/a
Published
2016-09-26
Title
W3 Total Cache < 0.9.5 – Unauthenticated Security Token Bypass
Fixed in
Fixed in 0.9.5
CVSS
n/a
Published
2016-09-26
Title
W3 Total Cache < 0.9.5 – Authenticated Arbitrary File Download
Fixed in
Fixed in 0.9.5
CVSS
n/a
Published
2016-09-21
Title
W3 Total Cache < 0.9.5 - Authenticated Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 0.9.5
CVSS
n/a
Published
2014-12-12
Title
W3 Total Cache <= 0.9.4 - Debug Mode XSS
Fixed in
Fixed in 0.9.4.1
CVSS
n/a
Published
2014-12-12
Title
W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 0.9.4.1
CVSS
n/a
Published
2014-09-28
Title
W3 Total Cache 0.9.4 - Edge Mode Enabling CSRF
Fixed in
Fixed in 0.9.4.1
CVSS
n/a
Published
2014-09-20
Title
W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated Arbitrary File Read
Fixed in
Fixed in 0.9.4
CVSS
8.6 (high)
Published
2014-08-01
Title
W3 Total Cache 0.9.2.4 - Username & Hash Extract
Fixed in
Fixed in 0.9.2.5
CVSS
7.5 (high)
Published
2014-08-01
Title
W3 Total Cache - Remote Code Execution
Fixed in
Fixed in 0.9.2.9
CVSS
9.8 (critical)