Skip to content
OpenAdvisories

Product · Bold Grid

W3 Total Cache

19 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.2
    CVE-2026-111254

    W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry

    The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate…

    Bold Grid W3 Total Cache Web / CMS
  • High 7.1
    CVE-2026-114178

    WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.

    Bold Grid W3 Total Cache
  • High 7.2
    CVE-2026-87920

    W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it pos…

    Bold Grid W3 Total Cache Web / CMS
  • High 7.2
    CVE-2026-78438

    W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator

    The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it pos…

    Bold Grid W3 Total Cache Web / CMS
  • High 7.2
    CVE-2026-18109

    W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

    The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated at…

    Bold Grid W3 Total Cache Web / CMS
  • High 7.5
    CVE-2026-9282 Scanner template

    W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter

    The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server,…

    Bold Grid W3 Total Cache Web / CMS
  • High 7.5
    CVE-2026-5032 Scanner template

    W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header

    The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing its entire output buffering and processing pipeline when the request's User-Agent header contains "W…

    Bold Grid W3 Total Cache Web / CMS
  • High 8.5
    CVE-2024-12365 Public exploit

    W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery

    The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Sub…

    Bold Grid W3 Total Cache Web / CMS