W3 Total Cache

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorBoldgrid (e666f6db-1a27-599c-be4b-0dab80fb37d2)
ProductW3 Total Cache (3e5fab11-0261-5ce4-bd1e-f5936a2e7b45)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/elliotsegler/w3-total-cache purl2cpe 2026-06-01 10:12:48.387871
pkg:github/wp-plugins/w3-total-cache purl2cpe 2026-06-01 10:12:48.387873

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-78438 vulnerable 2026-09-16 04:33:44.721083 W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator
HIGH (7.2)
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the "Lazy Load Images" feature with "Process background images" to be enabled, and the malicious comment to be approved by a moderator before execution is triggered.
Published: 2026-09-05T06:37:57.143Z
Updated: 2026-09-07T11:17:25.776Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-66695 vulnerable 2026-09-16 04:32:55.020822 WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability
MEDIUM (6.5)
Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions.
Published: 2026-08-06T14:28:03.503Z
Updated: 2026-08-06T15:35:19.950Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-9282 vulnerable 2026-07-29 01:09:06.980717 W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter
HIGH (7.5)
The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires enabling manual minify mode and supplying a manual-format minify filename so that the hash is empty and the f_array[] entries are not overwritten before reaching setupSources().
Published: 2026-07-11T06:50:33.051Z
Updated: 2026-07-14T14:29:14.909Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-57623 vulnerable 2026-07-29 01:03:15.713039 WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability
CRITICAL (9)
Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.
Published: 2026-07-02T11:15:25.775Z
Updated: 2026-07-02T14:37:19.947Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-5032 vulnerable 2026-06-08 08:07:02.905030 W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header
HIGH (7.5)
The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing its entire output buffering and processing pipeline when the request's User-Agent header contains "W3 Total Cache", which causes raw mfunc/mclude dynamic fragment HTML comments — including the W3TC_DYNAMIC_SECURITY security token — to be rendered in the page source. This makes it possible for unauthenticated attackers to discover the value of the W3TC_DYNAMIC_SECURITY constant by sending a crafted User-Agent header to any page that contains developer-placed dynamic fragment tags, granted the site has the fragment caching feature enabled. With the leaked W3TC_DYNAMIC_SECURITY token, an attacker can craft valid mfunc tags to execute arbitrary PHP code on the server, achieving remote code execution.
Published: 2026-04-02T07:39:36.011Z
Updated: 2026-04-08T17:13:29.087Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27384 vulnerable 2026-06-08 07:53:22.286769 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-12365 vulnerable 2026-06-08 06:23:51.787615 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-12008 vulnerable 2026-06-08 06:23:50.909770 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-12006 vulnerable 2026-06-08 06:23:50.907746 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-5359 vulnerable 2026-06-08 06:19:43.357822 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-24452 vulnerable 2026-06-08 05:30:04.402077 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-24436 vulnerable 2026-06-08 05:30:04.378170 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-24427 vulnerable 2026-06-08 05:30:04.361423 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-6079 vulnerable 2026-06-08 05:02:59.217373 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-6078 vulnerable 2026-06-08 05:02:59.217009 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-6077 vulnerable 2026-06-08 05:02:59.216580 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.