W3 Total Cache vulnerabilities

Known security issues in the W3 Total Cache WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: w3-total-cache
Latest version: 2.10.7
Active installs: 900,000+
Known vulnerabilities: 58
Data updated: 2026-10-18 09:17 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 2.10.7 (1)

W3 Total Cache: Fixed in version 2.10.7
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVE-2026-87920 · Source	High	7.2	< 2.10.7	2026-09-04

Fixed in version 2.10.6 (2)

W3 Total Cache: Fixed in version 2.10.6
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator CVE-2026-78438 · Source	High	7.2	< 2.10.6	2026-08-21
[en] The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that CVE-2026-107321 · Source	Not rated	-	< 2.10.6	2026-10-10

Fixed in version 2.10.5 (1)

W3 Total Cache: Fixed in version 2.10.5
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache < 2.10.5 - Unauthenticated Path Traversal CVE-2026-18051 · Source	Not rated	-	< 2.10.5	2026-08-19

Fixed in version 2.10.4 (1)

W3 Total Cache: Fixed in version 2.10.4
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name CVE-2026-18109 · Source	High	7.2	< 2.10.4	2026-08-13

Fixed in version 2.10.3 (1)

W3 Total Cache: Fixed in version 2.10.3
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache <= 2.10.2 - Unauthenticated Path Traversal CVE-2026-66695 · Source	Medium	6.5	< 2.10.3	2026-07-31

Fixed in version 2.10.0 (2)

W3 Total Cache: Fixed in version 2.10.0
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary Code Execution CVE-2026-57623 · Source	Critical	9.0	< 2.10.0	2026-06-29
W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter CVE-2026-9282 · Source	High	7.5	< 2.10.0	2026-07-10

Fixed in version 2.9.4 (1)

W3 Total Cache: Fixed in version 2.9.4
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header CVE-2026-5032 · Source	Not rated	-	< 2.9.4	0000-00-00

Fixed in version 2.9.2 (2)

W3 Total Cache: Fixed in version 2.9.2
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache <= 2.9.1 - Unauthenticated Arbitrary Code Execution CVE-2026-27384 · Source	Critical	9.0	< 2.9.2	2026-02-24
W3 Total Cache <= 2.9.1 - Missing Authorization CVE-2026-39595 · Source	Medium	4.7	< 2.9.2	2026-03-12

Fixed in version 2.8.13 (1)

W3 Total Cache: Fixed in version 2.8.13
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache < 2.8.13 - Unauthenticated Command Injection CVE-2025-9501 · Source	Not rated	-	< 2.8.13	0000-00-00

Fixed in version 2.8.2 (3)

W3 Total Cache: Fixed in version 2.8.2
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery CVE-2024-12365 · Source	High	8.5	< 2.8.2	2025-01-13
WordPress W3 Total Cache Plugin <= 2.8.1 is vulnerable to Sensitive Data Exposure CVE-2024-12008 · Source	Medium	5.3	< 2.8.2	2025-01-13
W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation CVE-2024-12006 · Source	Medium	5.3	< 2.8.2	2025-01-13

Fixed in version 2.7.6 (1)

W3 Total Cache: Fixed in version 2.7.6
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress W3 Total Cache Plugin <= 2.7.5 is vulnerable to Sensitive Data Exposure CVE-2023-5359 · Source	High	7.5	< 2.7.6	2024-09-23

Fixed in version 2.2.3 (1)

W3 Total Cache: Fixed in version 2.2.3
Vulnerability	Severity	CVSS	Affected versions	Published
Guzzle <= 6.5.7 and 7.0-7.4.4 - Information Exposure CVE-2022-31090 · Source	High	7.7	< 2.2.3	2022-06-20

Fixed in version 2.1.5 (1)

W3 Total Cache: Fixed in version 2.1.5
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress W3 Total Cache plugin <= 2.1.4 - Reflected Cross-Site Scripting (XSS) vulnerability CVE-2021-24452 · Source	Medium	6.1	< 2.1.5	2021-06-28

Fixed in version 2.1.4 (1)

W3 Total Cache: Fixed in version 2.1.4
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress W3 Total Cache plugin <= 2.1.3 - Reflected Cross-Site Scripting (XSS) vulnerability CVE-2021-24436 · Source	Medium	6.1	< 2.1.4	2021-06-28

Fixed in version 2.1.3 (1)

W3 Total Cache: Fixed in version 2.1.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress W3 Total Cache plugin <= 2.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability CVE-2021-24427 · Source	Medium	4.8	< 2.1.3	2021-04-25

Fixed in version 0.9.7.4 (7)

W3 Total Cache: Fixed in version 0.9.7.4
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache <= 0.9.7.3 - Server Side Request Forgery No CVE assigned · Source	Not rated	-	< 0.9.7.4	2019-05-22
WordPress W3 Total Cache plugin <= 0.9.7.3 - Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 0.9.7.4	2019-05-07
W3 Total Cache <= 0.9.7.3 - Improper Input Validation via openssl_verify No CVE assigned · Source	Not rated	-	< 0.9.7.4	2019-05-07
W3 Total Cache plugin <= 0.9.7.3 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 0.9.7.4	2019-05-07
W3 Total Cache < 0.9.7.3 - Cryptographic Signature Bypass No CVE assigned · Source	Not rated	-	< 0.9.7.4	-
W3 Total Cache < 0.9.7.4 - Blind SSRF and RCE via phar No CVE assigned · Source	Not rated	-	< 0.9.7.4	-
W3 Total Cache <= 0.9.7.3 - Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 0.9.7.4	-

Fixed in version 0.9.5 (20)

W3 Total Cache: Fixed in version 0.9.5
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache <= 0.9.4.1 - Weak validation of Amazon SNS push messages No CVE assigned · Source	Not rated	-	< 0.9.5	2016-11-10
W3 Total Cache <= 0.9.4 - Server-Side Request Forgery leading to Host Information Disclosure No CVE assigned · Source	Not rated	-	< 0.9.5	2016-10-31
WordPress W3 Total Cache Plugin <= 0.9.4.1 - Bypass No CVE assigned · Source	Not rated	-	< 0.9.5	2016-09-27
WordPress W3 Total Cache Plugin <= 0.9.4.1 - Arbitrary File Upload No CVE assigned · Source	Not rated	-	< 0.9.5	2016-09-27
WordPress W3 Total Cache Plugin <= 0.9.4.1 - Arbitrary File Download No CVE assigned · Source	Not rated	-	< 0.9.5	2016-09-27
WordPress W3 Total Cache Plugin <= 0.9.4.1 - Arbitrary PHP Code Execution No CVE assigned · Source	Not rated	-	< 0.9.5	2016-09-27
WordPress W3 Total Cache Plugin <= 0.9.4.1 - Reflected Cross Site Scripting No CVE assigned · Source	Not rated	-	< 0.9.5	2016-09-26
W3 Total Cache <= 0.9.4.1 - Security Token Bypass via Type Juggling No CVE assigned · Source	Not rated	-	< 0.9.5	2016-09-26
W3 Total Cache <= 0.9.4.1 - Arbitrary File Upload No CVE assigned · Source	Not rated	-	< 0.9.5	2016-09-26
W3 Total Cache <= 0.9.4.1 - Authenticated Arbitrary File Download No CVE assigned · Source	Not rated	-	< 0.9.5	2016-09-26
W3 Total Cache <= 0.9.4.1 - Arbitrary Code Execution via settings import No CVE assigned · Source	Not rated	-	< 0.9.5	2016-09-26
W3 Total Cache <= 0.9.4.1 - Cross-Site Scripting via request_id No CVE assigned · Source	Not rated	-	< 0.9.5	2016-07-29
W3 Total Cache <= 0.9.4.1 - Weak Validation of Amazon SNS Push Messages No CVE assigned · Source	Not rated	-	< 0.9.5	-
W3 Total Cache <= 0.9.4.1 - Information Disclosure Race Condition No CVE assigned · Source	Not rated	-	< 0.9.5	-
W3 Total Cache <= 0.9.4 - Unauthenticated Server Side Request Forgery (SSRF) No CVE assigned · Source	Not rated	-	< 0.9.5	-
W3 Total Cache <= 0.9.4.1 – Authenticated Arbitrary File Download No CVE assigned · Source	Not rated	-	< 0.9.5	-
W3 Total Cache <= 0.9.4.1 – Authenticated Arbitrary File Upload No CVE assigned · Source	Not rated	-	< 0.9.5	-
W3 Total Cache <= 0.9.4.1 – Authenticated Arbitrary PHP Code Execution No CVE assigned · Source	Not rated	-	< 0.9.5	-
W3 Total Cache <= 0.9.4.1 – Unauthenticated Security Token Bypass No CVE assigned · Source	Not rated	-	< 0.9.5	-
W3 Total Cache <= 0.9.4.1 - Authenticated Reflected Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 0.9.5	-

Fixed in version 0.9.4.1 (5)

W3 Total Cache: Fixed in version 0.9.4.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress W3 Total Cache Plugin <= 0.9.4 - Cross Site Request Forgery No CVE assigned · Source	Not rated	-	< 0.9.4.1	2015-05-15
WordPress W3 Total Cache Plugin <= 0.9.4 - XSS CVE-2014-8724 · Source	Low	0.0	< 0.9.4.1	2014-11-10
WordPress W3 Total Cache plugin <= 0.9.4 - Cross-Site Request Forgery (CSRF) vulnerability CVE-2014-9414 · Source	Low	0.0	< 0.9.4.1	2014-09-08
W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 0.9.4.1	2014-09-08
W3 Total Cache 0.9.4 - Edge Mode Enabling CSRF No CVE assigned · Source	Not rated	-	< 0.9.4.1	-

Fixed in version 0.9.4 (1)

W3 Total Cache: Fixed in version 0.9.4
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated Arbitrary File Read CVE-2019-6715 · Source	High	7.5	< 0.9.4	2019-04-01

Fixed in version 0.9.2.9 (2)

W3 Total Cache: Fixed in version 0.9.2.9
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache - Remote Code Execution CVE-2013-2010 · Source	Critical	9.8	< 0.9.2.9	2014-08-01
WordPress W3 Total Cache plugin <= 0.9.2.8 - PHP Code Execution vulnerability No CVE assigned · Source	Not rated	-	< 0.9.2.9	2013-05-01

Fixed in version 0.9.2.5 (3)

W3 Total Cache: Fixed in version 0.9.2.5
Vulnerability	Severity	CVSS	Affected versions	Published
W3 Total Cache 0.9.2.4 - Username & Hash Extract CVE-2012-6078 · Source	High	7.5	< 0.9.2.5	2019-11-22
W3 Total Cache <= 0.9.2.4 - Password Hash Extraction CVE-2012-6077 · Source	High	7.5	< 0.9.2.5	2019-11-22
W3 Total Cache <= 0.9.2.4 - Sensitive Information Exposure CVE-2012-6079 · Source	High	7.5	< 0.9.2.5	2019-11-22

Check every plugin on your site automatically

Install the free Webforta Security plugin for WordPress and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.