WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting

WordPress W3 Total Cache plugin before 2.1.5 is susceptible to cross-site scripting via the extension parameter in the Extensions dashboard, when the setting 'Anonymously track usage to improve product quality' is enabled. The parameter is output in a JavaScript context without proper escaping...

W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure

The W3 Total Cache WordPress plugin through version 2.9.3 skips its entire output buffering and processing pipeline whenever an incoming request's User-Agent header contains the string "W3 Total Cache", without authenticating the caller. On sites that use developer-placed dynamic fragment tags, t...

W3 Total Cache < 2.8.2 - Log File Exposure

The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF...

W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read

W3 Total Cache WordPress plugin = 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename. id: CVE-2026-9282 info: name: W3 Total Cache =...

w3-total-cache-cve-2013-2010

w3-total-cache-cve-2013-2010 تنفيذ كود عن بُعد على w3 total cache cve 2013-2010 الاستخدام: python3 w3tcrceexploit.py -u http://example.com -p "system'whoami';" الإخراج: Targeting: http://example.com + Payload sent successfully. + Check the target for execution of the payload. import requests impo...

Cleartext-Storage-vulnerability-CVE-2023-5359-in-W3-Total-Cache

Vulnérabilité de stockage en texte clair - CVE-2023-5359 dans W3 Total Cache Cible les versions ≤2.7.5 vulnérables à CVE-2023-5359 import requests import re from urllib.parse import urljoin Common paths where credentials are stored CREDENTIALPATHS =...

CVE-2024-12008-information-exposure-vulnerability-in-W3-Total-Cache

ثغرة كشف المعلومات CVE-2024-12008 في W3 Total Cache ثغرة كشف المعلومات CVE-2024-12008 في W3 Total Cache...

cve-2019-6715

cve-2019-6715 تحية إلى TomNomNom على 99.9% من كوده.... البناء root@kitploit: go get github.com/fatih/color go build الاستخدام root@kitploit: cat list.txt | ./2019-6715 جميع عناوين URL الثغرات مسجلة في text.log CVE 2019-6715 الوصف: يسمح ملف pub/sns.php في إضافة W3 Total Cache قبل الإصدار 0.9.4...

CVE-2018-18572

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:12+00:00| seen| https://t.me/hackingAttack/29057 2026-09-01 20:02:15+00:00| seen| https://t.me/hackingAttack/27123 2026-09-01 20:02:16+00:00| seen| https://t.me/hackingAttack/27119 2026-09-01 20:02:17+00:00| seen|...

CVE-2023-5359

CVE-2023-5359 - ثغرة التخزين غير المشفر في W3 Total Cache الوصف CVE-2023-5359 هي ثغرة تخزين غير مشفر تؤثر على إضافة ووردبريس W3 Total Cache في الإصدارات ≤ 2.7.5. تسمح هذه الثغرة للمهاجمين عن بُعد بالوصول إلى بيانات اعتماد حساسة مخزنة في ملفات PHP غير مشفرة وقابلة للوصول العام. الخطورة درجة CVSS :...

CVE-2026-27384

CVE-2026-27384 CVE-2026-27384 — Scanner RCE mfunc/eval pour W3 Total Cache Plugin: W3 Total Cache Plugin Slug: w3-total-cache CVE ID: CVE-2026-27384 CVSS Score: 9.8 Critique CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type de vulnérabilité: Exécution de code arbitraire non...

W3TotalChache

W3TotalChache Test auf CVE-2019-6715 Arbiträres Dateilesen/ CVE-2024-12365 SSRF/Informationsoffenlegung Verwendung: python3 w3tcscanner.py -u https://example.com -f /etc/passwd -d 3 import requests import argparse from urllib.parse import urlparse def checkw3tcversionurl: try: response =...

WordPress W3 Total Cache plugin < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability

Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability discovered by Jakub Herman in WordPress Plugin W3 Total Cache versions 2.10.5...

CVE-2026-18051

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

CVE-2026-18051 W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

EUVD-2026-62277

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

CVE-2026-18051

The W3 Total Cache WordPress plugin before 2.10.5 fails to validate the page cache key request path, enabling unauthenticated attackers to perform path traversal and write or overwrite arbitrary files anywhere on the server, including .htaccess on Apache. CVSS 10.0 (Critical) reflects no auth, no...

WordPress W3 Total Cache plugin <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Author Name vulnerability discovered by daroo in WordPress Plugin W3 Total Cache versions = 2.10.3...

CVE-2026-18109

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2026-18109

The CVE-2026-18109 entry concerns the W3 Total Cache WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in all versions up to and including 2.10.3 due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject scripts that execute when u...