CVE-2026-78438

The W3 Total Cache plugin for WordPress (versions ≤ 2.10.5 ) is affected by an unauthenticated Stored Cross-Site Scripting vulnerability in the LazyLoad Background Mutator component. Due to insufficient input sanitization and output escaping , attackers can inject arbitrary scripts via comment co...

WordPress W3 Total Cache plugin <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator vulnerability

Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator vulnerability discovered by theviper17y in WordPress Plugin W3 Total Cache versions = 2.10.5...

WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting

WordPress W3 Total Cache plugin before 2.1.5 is susceptible to cross-site scripting via the extension parameter in the Extensions dashboard, when the setting 'Anonymously track usage to improve product quality' is enabled. The parameter is output in a JavaScript context without proper escaping...

W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure

The W3 Total Cache WordPress plugin through version 2.9.3 skips its entire output buffering and processing pipeline whenever an incoming request's User-Agent header contains the string "W3 Total Cache", without authenticating the caller. On sites that use developer-placed dynamic fragment tags, t...

W3 Total Cache < 2.8.2 - Log File Exposure

The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF...

W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read

W3 Total Cache WordPress plugin = 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename. id: CVE-2026-9282 info: name: W3 Total Cache =...

w3-total-cache-cve-2013-2010

w3-total-cache-cve-2013-2010 Ejecución remota de código en w3 total cache cve 2013-2010 Uso: python3 w3tcrceexploit.py -u http://example.com -p "system'whoami';" Salida: Targeting: http://example.com + Payload sent successfully. + Check the target for execution of the payload. import requests...

Cleartext-Storage-vulnerability-CVE-2023-5359-in-W3-Total-Cache

Vulnerabilidad de almacenamiento en texto plano CVE-2023-5359 en W3 Total Cache Afecta a versiones ≤2.7.5 vulnerables a CVE-2023-5359 import requests import re from urllib.parse import urljoin Common paths where credentials are stored CREDENTIALPATHS =...

CVE-2024-12008-information-exposure-vulnerability-in-W3-Total-Cache

CVE-2024-12008 W3 Total Cache 中的信息暴露漏洞 CVE-2024-12008 W3 Total Cache 中的信息暴露漏洞...

cve-2019-6715

cve-2019-6715 感谢 TomNomNom，其代码贡献了本工具的 99.9%.... 构建 root@kitploit: go get github.com/fatih/color go build 用法 root@kitploit: cat list.txt | ./2019-6715 所有存在漏洞的 URL 都会记录在 text.log 中 CVE 2019-6715 描述：WordPress 的 W3 Total Cache 插件 0.9.4 之前版本中的 pub/sns.php 允许远程攻击者通过 SubscriptionConfirmation JSON 数据中的...

CVE-2018-18572

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:12+00:00| seen| https://t.me/hackingAttack/29057 2026-09-01 20:02:15+00:00| seen| https://t.me/hackingAttack/27123 2026-09-01 20:02:16+00:00| seen| https://t.me/hackingAttack/27119 2026-09-01 20:02:17+00:00| seen|...

CVE-2023-5359

CVE-2023-5359 - W3 Total Cache 明文存储漏洞 描述 CVE-2023-5359 是一个影响 WordPress 插件 W3 Total Cache （版本 ≤ 2.7.5）的明文存储漏洞。该漏洞允许远程攻击者访问存储在未加密且可公开访问的 PHP 文件中的敏感凭据。 严重性 CVSS 评分 : 7.5 高危 向量 : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 类型 : 敏感信息泄露 技术漏洞 根本原因 W3 Total Cache 将配置设置和 API 凭据存储在...

CVE-2026-27384

CVE-2026-27384 CVE-2026-27384 — Escáner de RCE mfunc/eval de W3 Total Cache Plugin: W3 Total Cache Slug del plugin: w3-total-cache ID de CVE: CVE-2026-27384 Puntuación CVSS: 9.8 Crítica Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Tipo de vulnerabilidad: Ejecución arbitraria de códig...

W3TotalChache

W3TotalChache Test auf CVE-2019-6715 Arbiträres Dateilesen/ CVE-2024-12365 SSRF/Informationsoffenlegung Verwendung: python3 w3tcscanner.py -u https://example.com -f /etc/passwd -d 3 import requests import argparse from urllib.parse import urlparse def checkw3tcversionurl: try: response =...

WordPress W3 Total Cache plugin < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability

Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability discovered by Jakub Herman in WordPress Plugin W3 Total Cache versions 2.10.5...

CVE-2026-18051

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

EUVD-2026-62277

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

CVE-2026-18051 W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

CVE-2026-18051

The W3 Total Cache WordPress plugin before 2.10.5 fails to validate the page cache key request path, enabling unauthenticated attackers to perform path traversal and write or overwrite arbitrary files anywhere on the server, including .htaccess on Apache. CVSS 10.0 (Critical) reflects no auth, no...

WordPress W3 Total Cache plugin <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Author Name vulnerability discovered by daroo in WordPress Plugin W3 Total Cache versions = 2.10.3...