WordPress plugin
W3 Total Cache security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 41 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High22
- Medium15
- Low2
All W3 Total Cache vulnerabilities
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder
≤2.10.7Update to 2.11.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry
≤2.10.7Update to 2.11.0
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.10.7Update to 2.11.0
- Medium6.5Authenticated (Author+) Path Traversal
≤2.10.5Update to 2.10.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
≤2.10.6Update to 2.10.7
- High7.2Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator
≤2.10.5Update to 2.10.6
- High7.5Unauthenticated Path Traversal
<2.10.5Update to 2.10.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
≤2.10.3Update to 2.10.4
- Medium5.3Unauthenticated Path Traversal
≤2.10.2Update to 2.10.3
- High7.5Unauthenticated Arbitrary File Read via 'f_array[]' Parameter
≤2.9.4Update to 2.10.0
- High8.1Unauthenticated Arbitrary Code Execution
≤2.9.4Update to 2.10.0
- High7.5Unauthenticated Security Token Exposure via User-Agent Header
≤2.9.3Update to 2.9.4
- Medium4.3Missing Authorization
≤2.9.1Update to 2.9.2
- Critical9.8Unauthenticated Arbitrary Code Execution
≤2.9.1Update to 2.9.2
- High8.1Unauthenticated Command Injection
≤2.8.12Update to 2.8.13
- High8.5Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery
≤2.8.1Update to 2.8.2
- Medium5.3W3 Total Cache <= 2.8.1 Information Exposure via Log Files
≤2.8.1Update to 2.8.2
- Medium5.3W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation
≤2.8.1Update to 2.8.2
- Low3.7Sensitive Credentials Stored in Plaintext
≤2.7.5Update to 2.7.6
- High7.7Information Exposure
≤2.2.2Update to 2.2.3
- Medium6.1Reflected Cross-Site Scripting via extension
<2.1.4Update to 2.1.4
- High7.2Reflected Cross-Site Scripting via extension
0.5 – 2.1.4Update to 2.1.5
- Medium4.8W3 Total Cache <= 2.1.2 Authenticated (Admin+) Stored Cross-Site Scripting
<2.1.3Update to 2.1.3
- High7.5File Read / Directory Traversal
0.9.2.6 – 0.9.3Update to 0.9.4
- High7.5Password Hash Extraction
≤0.9.2.4Update to 0.9.2.5
- High7.5Insecure Cryptography to Sensitive Information Disclosure
≤0.9.2.4Update to 0.9.2.5
- High7.5Sensitive Information Exposure
≤0.9.2.4Update to 0.9.2.5
- Medium5.4Server Side Request Forgery
≤0.9.7.3Update to 0.9.7.4
- Medium6.1Reflected Cross-Site Scripting
≤0.9.7.3Update to 0.9.7.4
- Medium4.3Improper Input Validation via openssl_verify
≤0.9.7.3Update to 0.9.7.4
- High7.2Weak validation of Amazon SNS push messages
≤0.9.4.1Update to 0.9.5
- High8.6Server-Side Request Forgery leading to Host Information Disclosure
≤0.9.4Update to 0.9.5
- Medium4.9Authenticated Arbitrary File Download
≤0.9.4.1Update to 0.9.5
- Low3.7Security Token Bypass via Type Juggling
≤0.9.4.1Update to 0.9.5
- High8.8Arbitrary File Upload
≤0.9.4.1Update to 0.9.5
- High7.2Arbitrary Code Execution via settings import
≤0.9.4.1Update to 0.9.5
- Medium6.1Cross-Site Scripting via request_id
≤0.9.4.1Update to 0.9.5
- Medium5.4Cross-Site Scripting
≤0.9.4Update to 0.9.4.1
- Medium4.3Cross-Site Request Forgery
≤0.9.4Update to 0.9.4.1
- High8.8Cross-Site Request Forgery leading to Stored Cross-Site Scripting
≤0.9.4Update to 0.9.4.1
- Critical9.8Remote Code Execution
≤0.9.2.8Update to 0.9.2.9
W3 Total Cache: common questions
Does W3 Total Cache have known vulnerabilities?
Yes. VulnCrest Radar lists 41 known vulnerabilities in W3 Total Cache: 2 critical, 22 high, 15 medium, 2 low. None are known to affect version null.
How do I check which version of W3 Total Cache I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent W3 Total Cache vulnerability?
CVE-2026-120019, published Oct 30, 2026: W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder. Severity: Medium (CVSS 5.4).
Is any W3 Total Cache vulnerability listed in CISA KEV?
No. None of the known W3 Total Cache vulnerabilities is currently listed in the CISA KEV catalog.