W3 Total Cache
by WordPress
Source repositories
CVEs (24)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-9282 | Hig | 0.00 | 7.5 | 0.03 | Jul 11, 2026 | The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain… | ||
| CVE-2026-57623 | Cri | 0.00 | 9.0 | 0.01 | Jul 2, 2026 | Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions. | ||
| CVE-2014-9414 | 0.00 | — | 0.01 | Dec 24, 2014 | The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and hijack the authentication of administrators for requests that change the mobile site redirect URI… | |||
| CVE-2014-8724 | 0.00 | — | 0.02 | Dec 19, 2014 | Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATH_INFO to the… |
- risk 0.00cvss 7.5epss 0.03
The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain…
- risk 0.00cvss 9.0epss 0.01
Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.
- CVE-2014-9414Dec 24, 2014risk 0.00cvss —epss 0.01
The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and hijack the authentication of administrators for requests that change the mobile site redirect URI…
- CVE-2014-8724Dec 19, 2014risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATH_INFO to the…
Page 2 of 2