2375 matches found
CVE-2026-18051
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...
EUVD-2026-62277
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...
CVE-2026-18051 W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...
CVE-2026-18051
The W3 Total Cache WordPress plugin (versions before 2.10.5 ) is vulnerable to an unauthenticated arbitrary directory file write via a path traversal vulnerability in the Disk: Enhanced page cache functionality. The root cause is that the plugin builds on-disk cache filenames directly from the ra...
PT-2026-78348
Unauthenticated SQL Injection in Total Donations = 2.0.5 versions...
PT-2026-78291
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...
CVE-2026-73391: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Total Donations = 2.0.5 versions...
CVE-2026-73390: Incorrect Privilege Assignment
Unauthenticated Privilege Escalation in Total Donations = 2.0.5 versions...
PT-2026-78347
Name of the Vulnerable Software and Affected Versions Total Donations versions prior to 2.0.6 Description An issue allows unauthenticated users to perform privilege escalation. Recommendations Update to a version newer than 2.0.5...
CVE-2026-18051: Improper Limitation of a Pathname to a Restricted Directory
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...
WordPress W3 Total Cache plugin <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name vulnerability
Unauthenticated Stored Cross-Site Scripting via Comment Author Name vulnerability discovered by daroo in WordPress Plugin W3 Total Cache versions = 2.10.3...
WordPress Total Upkeep (BoldGrid Backup) plugin < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret (regression of CVE-2020-36848) vulnerability
Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cronsecret regression of CVE-2020-36848 vulnerability discovered by Jakub Herman in WordPress Plugin Total Upkeep versions 1.17.3...
CVE-2026-18109
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
CVE-2026-18109
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.10.3 . The root cause is insufficient input sanitization and output escaping of the Comment Author Name . An unauthenticated attacker can inject arbitrary web scripts t...
CVE-2026-18109 W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
CVE-2026-18109 W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
CVE-2026-18109
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
EUVD-2026-58570
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
PT-2026-71950
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
VulnCheck KEV: CVE-2026-18109
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...