EUVD-2026-58570

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2026-66695

Unauthenticated Path Traversal in W3 Total Cache = 2.10.2 versions...

CVE-2026-66695 WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability

Unauthenticated Path Traversal in W3 Total Cache = 2.10.2 versions...

WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability

Path Traversal vulnerability discovered by Mykel Nelson in WordPress Plugin W3 Total Cache versions = 2.10.2...

WordPress W3 Total Cache plugin <= 2.9.4 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by snr in WordPress Plugin W3 Total Cache versions = 2.9.4...

EUVD-2026-43164

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2026-9282

The connected documents confirm a directory traversal vulnerability in the W3 Total Cache WordPress plugin, affecting all versions up to and including 2.9.4. The issue arises through the setupSources function, enabling unauthenticated attackers to read arbitrary server files that may contain sens...

CVE-2026-9282 W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2026-57623

Unauthenticated Arbitrary Code Execution in W3 Total Cache = 2.9.4 versions...

CVE-2026-57623

CVE-2026-57623 affects the WordPress W3 Total Cache plugin (versions

CVE-2026-57623 WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability

Unauthenticated Arbitrary Code Execution in W3 Total Cache = 2.9.4 versions...

CVE-2026-57623

Unauthenticated Arbitrary Code Execution in W3 Total Cache = 2.9.4 versions...

WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin W3 Total Cache versions = 2.9.4...

EUVD-2026-38758

The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 5.17.7 via the 'banner' attribute of the adrotate shortcode. This is due to insufficient input validation and sanitization of the banner shortcode attribute before...

CVE-2026-12242

CVE-2026-12242 affects the WordPress AdRotate Banner Manager plugin up to version 5.17.7. The vulnerability is PHP Code Injection via the banner attribute of the adrotate shortcode, caused by insufficient validation and sanitization before concatenation into a PHP code string wrapped in W3 Total ...

CVE-2026-39595

Author Broken Access Control in W3 Total Cache = 2.9.1 versions...

CVE-2026-39595 WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability

Author Broken Access Control in W3 Total Cache = 2.9.1 versions...

CVE-2026-36794

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.32204 was discovered to contain multiple stack overflows in the R7WebsSecurityHandler function via the username and password parameters. These vulnerabilities allow attackers to cause a Denial of Service DoS via a crafted HTTP...

CVE-2026-36777

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.32204 was discovered to contain a stack overflow in the param1 parameter of the formSetCfm function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted HTTP request...

CVE-2026-36792

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.32204 was discovered to contain a stack overflow in the wlradio parameter of the formWifiRadioSet function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted HTTP request...