W3 Total Cache
Monthly
Stored cross-site scripting in the W3 Total Cache WordPress plugin, affecting all versions up to and including 2.10.7, allows an attacker who already holds a previously approved commenter identity to plant script that is later served from cache to other visitors. Exploitation is tightly gated rather than a default-configuration scenario: the site must have had a W3 Total Cache Pro license with REST caching enabled, that license must have since lapsed, and Disk Enhanced page caching must still be configured so an unlicensed REST cache mode persists and responses get stored and served as static HTML. There is no CISA KEV entry and no public exploit identified at time of analysis; the assessed vector (AC:H/PR:L) is materially narrower than the published 7.2 CVSS score, which places this in the this-week queue rather than an emergency for most deployments.
Stored cross-site scripting in the Bold Grid WordPress plugin W3 Total Cache, affecting every version through 2.10.7, lets an attacker persist a script payload that then runs in the browser of a user who loads the affected page. The CVSS 3.1 score is 7.1 with scope change (S:C) and required user interaction (UI:R), so a victim - typically a privileged user viewing the rendered output - must load the tainted page before the payload fires. Exploitation status: no public exploit identified at time of analysis; the issue is not listed in CISA KEV and no EPSS value was supplied, and the priority label is 'this week' rather than emergency.
Stored cross-site scripting in the W3 Total Cache plugin for WordPress (all versions up to and including 2.10.6) lets unauthenticated attackers submit a comment containing crafted script payload that is later rendered unsanitized in a page, executing in the browser of any user or administrator who views it - but only on sites where the 'Remove query strings from static resources' option is enabled, since the plugin's output-buffer URL rewrite must strip the '?' delimiter and the closing quote of the enclosing HTML attribute to break out of the attribute context. The issue is fixed in 2.10.7, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because the required caching option is not the default configuration and execution depends on a victim subsequently viewing the injected page, the assessed vector rates this as attack complexity High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) even though the vendor-published score is 7.2 with AC:L.
Stored Cross-Site Scripting in W3 Total Cache (WordPress plugin) versions up to and including 2.10.5 allows unauthenticated attackers to inject arbitrary JavaScript via comment content processed by the LazyLoad Background Mutator. The flaw stems from insufficient sanitization and output escaping in UserExperience_LazyLoad_Mutator.php, specifically where comment text containing background-image CSS is mutated for lazy loading. Exploitation requires two non-default conditions: the Lazy Load Images feature with 'Process background images' enabled, and the malicious comment must be approved by a moderator before the payload executes against visiting users. A vendor-released patch is available in version 2.10.6.
Stored cross-site scripting in W3 Total Cache WordPress plugin (all versions through 2.10.3) allows unauthenticated attackers to inject and persistently execute arbitrary JavaScript in victim browsers by embedding malicious content in the Comment Author Name field. The payload is activated exclusively when the plugin's Lazy Load Images feature is enabled, as the unsafe output occurs within the LazyLoad mutator's img tag rewriting step. No public exploit code or CISA KEV listing is identified at time of analysis, but the network-accessible, unauthenticated attack vector with scope change represents meaningful risk for any WordPress site with both public commenting and lazy load simultaneously active.
Unauthenticated arbitrary code execution affects the W3 Total Cache WordPress caching plugin in all versions up to and including 2.9.4, allowing remote attackers to execute code and fully compromise the underlying site without credentials or user interaction. The scope-changing CVSS 9.0 (Critical) rating reflects the plugin's deep hooks into WordPress request handling. There is no public exploit identified at time of analysis and no CISA KEV listing, though the high exploitability of a widely deployed plugin makes it a strong patching priority.
W3 Total Cache plugin for WordPress exposes security tokens to unauthenticated remote attackers through User-Agent header manipulation. Versions up to 2.9.3 bypass output buffering when requests contain 'W3 Total Cache' in the User-Agent, leaking W3TC_DYNAMIC_SECURITY tokens embedded in dynamic fragment HTML comments. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicating trivial exploitation requiring no authentication, attackers can extract these tokens from any page using fragment caching, enabling potential security bypass or escalation attacks. Patch available in version 2.9.4+ per upstream changeset.
Stored cross-site scripting in the WordPress plugin W3 Total Cache (all versions up to and including 2.10.7) lets unauthenticated attackers inject arbitrary web scripts through the 'comment' parameter, which then execute when a user loads the injected page. The flaw is not unconditional: HTML Minify must be enabled, the default 'mfunc' entry must remain in the ignored-comment stems list, and the attacker must predict the md5(time()) placeholder namespace by reading the server clock from the HTTP Date response header within the applicable time window, which is why the assessed vector carries AC:H. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an upstream fix commit plus a changeset for the affected IgnoredCommentPreserver code; this is a genuine but conditional, moderate-severity issue rather than a top-tier emergency.
Path traversal in W3 Total Cache WordPress plugin (versions ≤ 2.10.2) enables remote unauthenticated attackers to manipulate files outside the intended cache directory without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation; the C:N/I:L/A:L impact profile indicates this traversal affects file integrity and availability rather than exposing arbitrary file reads, suggesting a write- or delete-capable traversal rather than a classic information-disclosure variant. No public exploit code and no CISA KEV listing are identified at time of analysis.
W3 Total Cache for WordPress (versions through 2.9.1) exposes Author-role users to administrative plugin functions due to missing authorization checks (CWE-862), enabling unintended read, write, and availability impacts against the caching layer. The CVSS vector confirms a network-accessible, low-complexity exploit requiring Author-level authentication (PR:H), with low but confirmed impact across all three CIA dimensions. No public exploit code or active exploitation via CISA KEV has been identified at the time of analysis.
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 17.0%.
The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug log file. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 33.5%.
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.8.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and hijack the. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Stored cross-site scripting in the W3 Total Cache WordPress plugin, affecting all versions up to and including 2.10.7, allows an attacker who already holds a previously approved commenter identity to plant script that is later served from cache to other visitors. Exploitation is tightly gated rather than a default-configuration scenario: the site must have had a W3 Total Cache Pro license with REST caching enabled, that license must have since lapsed, and Disk Enhanced page caching must still be configured so an unlicensed REST cache mode persists and responses get stored and served as static HTML. There is no CISA KEV entry and no public exploit identified at time of analysis; the assessed vector (AC:H/PR:L) is materially narrower than the published 7.2 CVSS score, which places this in the this-week queue rather than an emergency for most deployments.
Stored cross-site scripting in the Bold Grid WordPress plugin W3 Total Cache, affecting every version through 2.10.7, lets an attacker persist a script payload that then runs in the browser of a user who loads the affected page. The CVSS 3.1 score is 7.1 with scope change (S:C) and required user interaction (UI:R), so a victim - typically a privileged user viewing the rendered output - must load the tainted page before the payload fires. Exploitation status: no public exploit identified at time of analysis; the issue is not listed in CISA KEV and no EPSS value was supplied, and the priority label is 'this week' rather than emergency.
Stored cross-site scripting in the W3 Total Cache plugin for WordPress (all versions up to and including 2.10.6) lets unauthenticated attackers submit a comment containing crafted script payload that is later rendered unsanitized in a page, executing in the browser of any user or administrator who views it - but only on sites where the 'Remove query strings from static resources' option is enabled, since the plugin's output-buffer URL rewrite must strip the '?' delimiter and the closing quote of the enclosing HTML attribute to break out of the attribute context. The issue is fixed in 2.10.7, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because the required caching option is not the default configuration and execution depends on a victim subsequently viewing the injected page, the assessed vector rates this as attack complexity High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) even though the vendor-published score is 7.2 with AC:L.
Stored Cross-Site Scripting in W3 Total Cache (WordPress plugin) versions up to and including 2.10.5 allows unauthenticated attackers to inject arbitrary JavaScript via comment content processed by the LazyLoad Background Mutator. The flaw stems from insufficient sanitization and output escaping in UserExperience_LazyLoad_Mutator.php, specifically where comment text containing background-image CSS is mutated for lazy loading. Exploitation requires two non-default conditions: the Lazy Load Images feature with 'Process background images' enabled, and the malicious comment must be approved by a moderator before the payload executes against visiting users. A vendor-released patch is available in version 2.10.6.
Stored cross-site scripting in W3 Total Cache WordPress plugin (all versions through 2.10.3) allows unauthenticated attackers to inject and persistently execute arbitrary JavaScript in victim browsers by embedding malicious content in the Comment Author Name field. The payload is activated exclusively when the plugin's Lazy Load Images feature is enabled, as the unsafe output occurs within the LazyLoad mutator's img tag rewriting step. No public exploit code or CISA KEV listing is identified at time of analysis, but the network-accessible, unauthenticated attack vector with scope change represents meaningful risk for any WordPress site with both public commenting and lazy load simultaneously active.
Unauthenticated arbitrary code execution affects the W3 Total Cache WordPress caching plugin in all versions up to and including 2.9.4, allowing remote attackers to execute code and fully compromise the underlying site without credentials or user interaction. The scope-changing CVSS 9.0 (Critical) rating reflects the plugin's deep hooks into WordPress request handling. There is no public exploit identified at time of analysis and no CISA KEV listing, though the high exploitability of a widely deployed plugin makes it a strong patching priority.
W3 Total Cache plugin for WordPress exposes security tokens to unauthenticated remote attackers through User-Agent header manipulation. Versions up to 2.9.3 bypass output buffering when requests contain 'W3 Total Cache' in the User-Agent, leaking W3TC_DYNAMIC_SECURITY tokens embedded in dynamic fragment HTML comments. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicating trivial exploitation requiring no authentication, attackers can extract these tokens from any page using fragment caching, enabling potential security bypass or escalation attacks. Patch available in version 2.9.4+ per upstream changeset.
Stored cross-site scripting in the WordPress plugin W3 Total Cache (all versions up to and including 2.10.7) lets unauthenticated attackers inject arbitrary web scripts through the 'comment' parameter, which then execute when a user loads the injected page. The flaw is not unconditional: HTML Minify must be enabled, the default 'mfunc' entry must remain in the ignored-comment stems list, and the attacker must predict the md5(time()) placeholder namespace by reading the server clock from the HTTP Date response header within the applicable time window, which is why the assessed vector carries AC:H. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an upstream fix commit plus a changeset for the affected IgnoredCommentPreserver code; this is a genuine but conditional, moderate-severity issue rather than a top-tier emergency.
Path traversal in W3 Total Cache WordPress plugin (versions ≤ 2.10.2) enables remote unauthenticated attackers to manipulate files outside the intended cache directory without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation; the C:N/I:L/A:L impact profile indicates this traversal affects file integrity and availability rather than exposing arbitrary file reads, suggesting a write- or delete-capable traversal rather than a classic information-disclosure variant. No public exploit code and no CISA KEV listing are identified at time of analysis.
W3 Total Cache for WordPress (versions through 2.9.1) exposes Author-role users to administrative plugin functions due to missing authorization checks (CWE-862), enabling unintended read, write, and availability impacts against the caching layer. The CVSS vector confirms a network-accessible, low-complexity exploit requiring Author-level authentication (PR:H), with low but confirmed impact across all three CIA dimensions. No public exploit code or active exploitation via CISA KEV has been identified at the time of analysis.
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 17.0%.
The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug log file. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 33.5%.
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.8.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and hijack the. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.