CVE-2026-78438

The W3 Total Cache plugin for WordPress (versions ≤ 2.10.5 ) is affected by an unauthenticated Stored Cross-Site Scripting vulnerability in the LazyLoad Background Mutator component. Due to insufficient input sanitization and output escaping , attackers can inject arbitrary scripts via comment co...

EUVD-2026-71882

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting

WordPress W3 Total Cache plugin before 2.1.5 is susceptible to cross-site scripting via the extension parameter in the Extensions dashboard, when the setting 'Anonymously track usage to improve product quality' is enabled. The parameter is output in a JavaScript context without proper escaping...

W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure

The W3 Total Cache WordPress plugin through version 2.9.3 skips its entire output buffering and processing pipeline whenever an incoming request's User-Agent header contains the string "W3 Total Cache", without authenticating the caller. On sites that use developer-placed dynamic fragment tags, t...

W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read

W3 Total Cache WordPress plugin = 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename. id: CVE-2026-9282 info: name: W3 Total Cache =...

W3 Total Cache < 2.8.2 - Log File Exposure

The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF...

WordPress W3 Total Cache plugin <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator vulnerability

Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator vulnerability discovered by theviper17y in WordPress Plugin W3 Total Cache versions = 2.10.5...

w3-total-cache-cve-2013-2010

w3-total-cache-cve-2013-2010 w3 total cache cve 2013-2010에서 원격 코드 실행 사용법: python3 w3tcrceexploit.py -u http://example.com -p "system'whoami';" 출력: Targeting: http://example.com + Payload sent successfully. + Check the target for execution of the payload. import requests import argparse def...

Cleartext-Storage-vulnerability-CVE-2023-5359-in-W3-Total-Cache

W3 Total Cache의 Cleartext Storage 취약점 CVE-2023-5359 CVE-2023-5359에 취약한 버전 ≤2.7.5 대상 import requests import re from urllib.parse import urljoin Common paths where credentials are stored CREDENTIALPATHS = "/wp-content/plugins/w3-total-cache/ExtensionCloudFlarePlugin.php",...

CVE-2024-12008-information-exposure-vulnerability-in-W3-Total-Cache

CVE-2024-12008-information-exposure-vulnerability-in-W3-Total-Cache W3 Total Cache의 CVE-2024-12008 정보 노출 취약점...

cve-2019-6715

cve-2019-6715 TomNomNom에게 99.9%의 코드를 제공한 것에 감사드립니다.... 빌드 root@kitploit: go get github.com/fatih/color go build 사용법 root@kitploit: cat list.txt | ./2019-6715 모든 취약한 URL은 text.log에 기록됩니다. CVE 2019-6715 설명: WordPress용 W3 Total Cache 플러그인 0.9.4 이전 버전의 pub/sns.php는 SubscriptionConfirmation JSON 데이터의...

CVE-2018-18572

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:12+00:00| seen| https://t.me/hackingAttack/29057 2026-09-01 20:02:15+00:00| seen| https://t.me/hackingAttack/27123 2026-09-01 20:02:16+00:00| seen| https://t.me/hackingAttack/27119 2026-09-01 20:02:17+00:00| seen|...

CVE-2023-5359

CVE-2023-5359 - W3 Total Cache 평문 저장 취약점 설명 CVE-2023-5359 는 WordPress 플러그인 W3 Total Cache 버전 ≤ 2.7.5에 영향을 미치는 평문 저장 취약점입니다. 이 취약점으로 인해 원격 공격자는 공개적으로 접근 가능한 암호화되지 않은 PHP 파일에 저장된 민감한 자격 증명에 접근할 수 있습니다. 심각도 CVSS 점수 : 7.5 높음 벡터 : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 유형 : 민감 정보 노출 기술적 취약점 근본 원...

CVE-2026-27384

CVE-2026-27384 CVE-2026-27384 — W3 Total Cache mfunc/eval RCE 스캐너 플러그인: W3 Total Cache 플러그인 슬러그: w3-total-cache CVE ID: CVE-2026-27384 CVSS 점수: 9.8 치명적 CVSS 벡터: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 취약점 유형: 인증되지 않은 임의 코드 실행 eval을 통한 코드 인젝션 영향받는 버전: W3TC는 캐시에서 페이지를 제공할 때 이러한 태그를 처리합니다: 삽입된...

W3TotalChache

W3TotalChache Test auf CVE-2019-6715 Arbiträres Dateilesen/ CVE-2024-12365 SSRF/Informationsoffenlegung Verwendung: python3 w3tcscanner.py -u https://example.com -f /etc/passwd -d 3 import requests import argparse from urllib.parse import urlparse def checkw3tcversionurl: try: response =...

WordPress W3 Total Cache plugin < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability

Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability discovered by Jakub Herman in WordPress Plugin W3 Total Cache versions 2.10.5...

CVE-2026-18051

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

EUVD-2026-62277

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

CVE-2026-18051 W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

CVE-2026-18051

The W3 Total Cache WordPress plugin before 2.10.5 fails to validate the page cache key request path, enabling unauthenticated attackers to perform path traversal and write or overwrite arbitrary files anywhere on the server, including .htaccess on Apache. CVSS 10.0 (Critical) reflects no auth, no...