W3 Total Cache vulnerability: is your WooCommerce store affected?

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

1. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.2 (high)no login neededAffected: older than 2.11.0Fixed in 2.11.0Published 30 October 2026CVE-2026-111254

   Advisory: The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping.

2. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.1 (high)no login neededAffected: older than 2.11.0Fixed in 2.11.0Published 8 October 2026CVE-2026-114178

   Advisory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.

3. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.2 (high)no login neededAffected: older than 2.10.7Fixed in 2.10.7Published 4 September 2026CVE-2026-87920

   Advisory: The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input...

4. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.2 (high)no login neededAffected: older than 2.10.6Fixed in 2.10.6Published 21 August 2026CVE-2026-78438

   Advisory: The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input...

5. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.2 (high)no login neededAffected: older than 2.10.4Fixed in 2.10.4Published 13 August 2026CVE-2026-18109

   Advisory: The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping.

6. File access

   Someone could read files on your server they should never see.

   Score 7.5 (high)no login neededAffected: older than 2.10.0Fixed in 2.10.0Published 10 July 2026CVE-2026-9282

   Advisory: The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function.

7. Code execution

   Someone could run their own code on your server.

   Score 9.0 (critical)no login neededAffected: older than 2.10.0Fixed in 2.10.0Published 29 June 2026CVE-2026-57623

   Advisory: Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.

8. Code execution

   Someone could run their own code on your server.

   Score 9.0 (critical)no login neededAffected: older than 2.9.2Fixed in 2.9.2Published 24 February 2026CVE-2026-27384

   Advisory: Improper Validation of Specified Quantity in Input vulnerability in BoldGrid W3 Total Cache w3-total-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects W3 Total Cache: from n/a...

9. Missing permission check

   An action that should need permission could be done without it.

   Score 8.5 (high)needs only a customer accountAffected: older than 2.8.2Fixed in 2.8.2Published 13 January 2025CVE-2024-12365

   Advisory: The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1.

10. Data exposure

    Information meant to stay private could be read.

    Score 7.5 (high)no login neededAffected: older than 2.7.6Fixed in 2.7.6Published 23 September 2024CVE-2023-5359

    Advisory: The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets stored in plaintext in the publicly visible plugin source.

6 older holes, published before 1 January 2023

1. Data exposure

   The advisory names a component, not W3 Total Cache itself; the security database lists it under W3 Total Cache. Information meant to stay private could be read.

   Score 7.7 (high)needs only a customer accountAffected: older than 2.2.3Fixed in 2.2.3Published 20 June 2022CVE-2022-31090

   Advisory: Guzzle, an extensible PHP HTTP client.

2. Data exposure

   Information meant to stay private could be read.

   Score 7.5 (high)no login neededAffected: older than 0.9.2.5Fixed in 0.9.2.5Published 22 November 2019CVE-2012-6078

   Advisory: W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes.

3. Data exposure

   Information meant to stay private could be read.

   Score 7.5 (high)no login neededAffected: older than 0.9.2.5Fixed in 0.9.2.5Published 22 November 2019CVE-2012-6077

   Advisory: W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files.

4. Data exposure

   Information meant to stay private could be read.

   Score 7.5 (high)no login neededAffected: older than 0.9.2.5Fixed in 0.9.2.5Published 22 November 2019CVE-2012-6079

   Advisory: W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via their hash keys.

5. File access

   Someone could read files on your server they should never see.

   Score 7.5 (high)no login neededAffected: older than 0.9.4Fixed in 0.9.4Published 1 April 2019CVE-2019-6715

   Advisory: pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data.

6. Code execution

   Someone could run their own code on your server.

   Score 9.8 (critical)no login neededAffected: older than 0.9.2.9Fixed in 0.9.2.9Published 1 August 2014CVE-2013-2010

   Advisory: WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability

How to check your version

1. Log in to WordPress and open Plugins > Installed Plugins.
2. Find W3 Total Cache. The version number is under its name. If it is lower than 2.11.0, your store is affected.
3. No login to hand? Open https://yourstore.com/wp-content/plugins/w3-total-cache/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
2. On the copy, update W3 Total Cache to 2.11.0 or newer: Dashboard > Updates, or Update now on the Plugins page.
3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use W3 Total Cache.
5. If everything works, make the same update on the live store and place one more test order.
6. If you no longer use W3 Total Cache, delete it instead of leaving it deactivated.

Questions

Which W3 Total Cache version fixes it?

Version 2.11.0 or newer fixes all 16 issues on this page.

How do I know if my store is affected?

Your store is affected if it runs W3 Total Cache older than 2.11.0. In WordPress, open Plugins and read the version under W3 Total Cache. Without logging in, open yourstore.com/wp-content/plugins/w3-total-cache/readme.txt and read the Stable tag line.

I don't use W3 Total Cache any more. Is a deactivated copy safe?

Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.

Can someone fix it for me?

Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.