Advisories · Technology

boldgrid W3 Total Cache.

Every CVE that names boldgrid W3 Total Cache among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-120019 CVE record

CVSS 5.4 Medium

W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder
- boldgrid W3 Total Cache
- Cross-site scripting (XSS)
Not analysed yet 31 Oct 2026
CVE-2026-111254 CVE record

CVSS 7.2 High

W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry
- boldgrid W3 Total Cache
- Cross-site scripting (XSS)
Not analysed yet 31 Oct 2026
CVE-2026-87920 CVE record

CVSS 7.2 High

W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- boldgrid W3 Total Cache
- Cross-site scripting (XSS)
Not analysed yet 2 Oct 2026
CVE-2026-78438 CVE record

CVSS 7.2 High

W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator
- boldgrid W3 Total Cache
- Cross-site scripting (XSS)
Not analysed yet 5 Sept 2026
CVE-2026-18109 CVE record

CVSS 7.2 High

W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
- boldgrid W3 Total Cache
- Cross-site scripting (XSS)
Not analysed yet 14 Aug 2026
CVE-2026-66695 CVE record

CVSS 6.5 Medium

WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability
- BoldGrid W3 Total Cache
- Path traversal
Not analysed yet 6 Aug 2026
CVE-2026-9282 CVE record

CVSS 7.5 High

W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter
- boldgrid W3 Total Cache
- Path traversal
Not analysed yet 11 Jul 2026
CVE-2026-57623 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability
- BoldGrid W3 Total Cache
- CWE-1284
Not analysed yet 2 Jul 2026
CVE-2026-39595 CVE record

CVSS 4.7 Medium

WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability
- BoldGrid W3 Total Cache
- Broken access control
Not analysed yet 17 Jun 2026
CVE-2026-5032 CVE record

CVSS 7.5 High

W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header
- boldgrid W3 Total Cache
- Information disclosure
Not analysed yet 2 Apr 2026
CVE-2026-27384 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability
- BoldGrid W3 Total Cache
- CWE-1284
Not analysed yet 5 Mar 2026
CVE-2024-12008 CVE record

CVSS 5.3 Medium

W3 Total Cache <= 2.8.1 Information Exposure via Log Files
- boldgrid W3 Total Cache
- Information disclosure
Not analysed yet 14 Jan 2025
CVE-2024-12006 CVE record

CVSS 5.3 Medium

W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation
- boldgrid W3 Total Cache
- Broken access control
Not analysed yet 14 Jan 2025
CVE-2024-12365 CVE record

CVSS 8.5 High

W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery
- boldgrid W3 Total Cache
- Broken access control
Not analysed yet 14 Jan 2025
CVE-2023-5359 CVE record

CVSS 3.7 Low

W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext
- boldgrid W3 Total Cache
- Information disclosure
Not analysed yet 24 Sept 2024
CVE-2021-24452 CVE record

W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)
- BoldGrid W3 Total Cache
- Cross-site scripting (XSS)
Not analysed yet 19 Jul 2021
CVE-2021-24436 CVE record

W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)
- BoldGrid W3 Total Cache
- Cross-site scripting (XSS)
Not analysed yet 19 Jul 2021
CVE-2021-24427 CVE record

W3 Total Cache < 2.1.3 - Authenticated Stored XSS
- BoldGrid W3 Total Cache
- Cross-site scripting (XSS)
Not analysed yet 12 Jul 2021