W3 Total Cache

Vulnerabilities 49Slug w3-total-cacheLatest version 2.9.4WordPress.org →

Minimum safe version

2.9.4

Update to 2.9.4 or later to address 49 fixable vulnerabilities

Latest available2.9.4 ✓
N/A
2025-10-27< 2.8.13

W3 Total Cache <= 2.8.12 - Unauthenticated Command Injection

WordfenceCVE
N/A
2026-04-01< 2.9.4

W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header

WordfenceCVE
Critical 9.0
2026-03-05< 2.9.2

CVE-2026-27384

CVEWordfence
N/A
2014-09-08< 0.9.4.1

W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting

Wordfence
N/A
2016-07-29< 0.9.5

W3 Total Cache <= 0.9.4.1 - Cross-Site Scripting via request_id

Wordfence
N/A
2016-09-26< 0.9.5

W3 Total Cache <= 0.9.4.1 - Arbitrary Code Execution via settings import

Wordfence
N/A
2016-09-26< 0.9.5

W3 Total Cache <= 0.9.4.1 - Authenticated Arbitrary File Download

Wordfence
N/A
2016-09-26< 0.9.5

W3 Total Cache <= 0.9.4.1 - Arbitrary File Upload

Wordfence
N/A
2016-09-26< 0.9.5

W3 Total Cache <= 0.9.4.1 - Security Token Bypass via Type Juggling

Wordfence
N/A
2016-10-31< 0.9.5

W3 Total Cache <= 0.9.4 - Server-Side Request Forgery leading to Host Information Disclosure

Wordfence
N/A
2016-11-10< 0.9.5

W3 Total Cache <= 0.9.4.1 - Weak validation of Amazon SNS push messages

Wordfence
N/A
2019-05-07< 0.9.7.4

W3 Total Cache plugin <= 0.9.7.3 - Reflected Cross-Site Scripting

Wordfence
N/A
2019-05-07< 0.9.7.4

W3 Total Cache <= 0.9.7.3 - Improper Input Validation via openssl_verify

Wordfence
N/A
2019-05-22< 0.9.7.4

W3 Total Cache <= 0.9.7.3 - Server Side Request Forgery

Wordfence
High 7.5
2020-09-22< 0.9.2.5

W3 Total Cache <= 0.9.2.4 - Sensitive Information Exposure

WordfenceCVE
High 7.5
2020-09-22< 0.9.2.5

W3 Total Cache <= 0.9.2.4 - Password Hash Extraction

WordfenceCVE
High 7.5
2020-09-22< 0.9.2.5

W3 Total Cache <= 0.9.2.4 - Insecure Cryptography to Sensitive Information Disclosure

WordfenceCVEWPScan
N/A
< 0.9.4.1

W3 Total Cache 0.9.4 - Edge Mode Enabling CSRF

WPScan
N/A
< 0.9.5

W3 Total Cache &lt;= 0.9.4.1 - Authenticated Reflected Cross-Site Scripting (XSS)

WPScan
N/A
< 0.9.5

W3 Total Cache &lt;= 0.9.4.1 &ndash; Unauthenticated Security Token Bypass

WPScan
N/A
< 0.9.5

W3 Total Cache &lt;= 0.9.4.1 &ndash; Authenticated Arbitrary PHP Code Execution

WPScan
N/A
< 0.9.5

W3 Total Cache &lt;= 0.9.4.1 &ndash; Authenticated Arbitrary File Upload

WPScan
N/A
< 0.9.5

W3 Total Cache &lt;= 0.9.4.1 &ndash; Authenticated Arbitrary File Download

WPScan
N/A
< 0.9.5

W3 Total Cache &lt;= 0.9.4 - Unauthenticated Server Side Request Forgery (SSRF)

WPScan
N/A
< 0.9.5

W3 Total Cache &lt;= 0.9.4.1 - Information Disclosure Race Condition

WPScan
N/A
< 0.9.5

W3 Total Cache &lt;= 0.9.4.1 - Weak Validation of Amazon SNS Push Messages

WPScan
N/A
< 0.9.7.4

W3 Total Cache &lt;= 0.9.7.3 - Cross-Site Scripting (XSS)

WPScan
N/A
< 0.9.7.4

W3 Total Cache &lt; 0.9.7.4 - Blind SSRF and RCE via phar

WPScan
N/A
< 0.9.7.4

W3 Total Cache &lt; 0.9.7.3 - Cryptographic Signature Bypass

WPScan
N/A
2013-05-01< 0.9.2.9

WordPress W3 Total Cache plugin <= 0.9.2.8 - PHP Code Execution vulnerability

Patchstack
N/A
2015-05-15< 0.9.4.1

WordPress W3 Total Cache Plugin <= 0.9.4 - Cross Site Request Forgery

Patchstack
N/A
2016-09-26< 0.9.5

WordPress W3 Total Cache Plugin <= 0.9.4.1 - Reflected Cross Site Scripting

Patchstack
N/A
2016-09-27< 0.9.5

WordPress W3 Total Cache Plugin <= 0.9.4.1 - Arbitrary PHP Code Execution

Patchstack
N/A
2016-09-27< 0.9.5

WordPress W3 Total Cache Plugin <= 0.9.4.1 - Arbitrary File Download

Patchstack
N/A
2016-09-27< 0.9.5

WordPress W3 Total Cache Plugin <= 0.9.4.1 - Arbitrary File Upload

Patchstack
N/A
2016-09-27< 0.9.5

WordPress W3 Total Cache Plugin <= 0.9.4.1 - Bypass

Patchstack
N/A
2019-05-07< 0.9.7.4

WordPress W3 Total Cache plugin <= 0.9.7.3 - Cross-Site Scripting (XSS) vulnerability

Patchstack
High 7.5
2020-12-22< 0.9.4

W3 Total Cache 0.9.2.6-0.9.3 - File Read / Directory Traversal

WordfenceCVEWPScan