WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in W3 Total Cache

Search Engine (SEO) & Performance Optimization (WPO) via caching. Integrated caching: CDN, Page, Minify, Object, Fragment, Database support.

35Reported vulnerabilities
9.8Highest CVSS score
2.10.5Latest version
900,000+Active installs

What to do now

Update W3 Total Cache to 2.10.6 or later. 35 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 10, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2019-6715 High 7.5 19.4% Before 0.9.4 0.9.4 April 1, 2019
CVE-2025-9501 High 8.1 20.5% 2.8.12 and earlier 2.8.13 October 27, 2025
CVE-2014-9414 Medium 6.8 1.4% 0.9.4 and earlier 0.9.4.1 December 24, 2014
CVE-2021-24452 Medium 6.1 1.9% Before 2.1.5 2.1.5 July 19, 2021
CVE-2021-24436 Medium 6.1 1.9% Before 2.1.4 2.1.4 July 19, 2021
CVE-2026-27384 Critical 9.8 0.3% 2.9.1 and earlier 2.9.2 February 24, 2026
CVE-2012-6077 High 7.5 5.4% 0.9.2.4 and earlier 0.9.2.5 September 22, 2020
CVE-2024-12365 High 8.5 1.8% Before 2.8.2 2.8.2 January 14, 2025
CVE-2014-8724 Medium 4.3 2.1% 0.9.4 and earlier 0.9.4.1 December 19, 2014
CVE-2021-24427 Medium 4.8 0.6% Before 2.1.3 2.1.3 July 12, 2021
CVE-2026-5032 High 7.5 3.1% 0 to 2.9.3 (inclusive) 2.9.4 April 2, 2026
WF-c187ed25-6ba7-4a58-97df-5fea723d485a High 8.8 — 0.9.4.1 and earlier 0.9.5 September 26, 2016
WF-84227fd2-c322-45e3-82cd-70e1d870eceb High 8.8 — 0.9.4 and earlier 0.9.4.1 September 8, 2014
CVE-2026-9282 High 7.5 2.9% 0 to 2.9.4 (inclusive) 2.10.0 July 11, 2026
WF-b09c6da0-14d8-4e44-95bd-b5b6b0df97e9 High 8.6 — 0.9.4 and earlier 0.9.5 October 31, 2016
CVE-2026-57623 High 8.1 0.5% 2.9.4 and earlier 2.10.0 June 29, 2026
CVE-2024-12008 High 7.5 2.3% Before 2.8.2 2.8.2 January 14, 2025
CVE-2022-31090 High 7.7 1.9% 2.2.2 and earlier 2.2.3 June 20, 2022
CVE-2012-6079 High 7.5 2.1% 0.9.2.4 and earlier 0.9.2.5 September 22, 2020
CVE-2012-6078 High 7.5 2.3% 0.9.2.4 and earlier 0.9.2.5 September 22, 2020
CVE-2023-5359 High 7.5 0.8% Before 2.7.6 2.7.6 September 25, 2024
CVE-2026-18051 High 7.5 0.4% Before 2.10.5 2.10.5 August 21, 2026
CVE-2026-78438 High 7.2 0.3% 0 to 2.10.5 (inclusive) 2.10.6 September 5, 2026
CVE-2026-18109 High 7.2 0.3% 0 to 2.10.3 (inclusive) 2.10.4 August 14, 2026
WF-9373c82d-15a8-495a-8290-1b85c096f7e5 High 7.2 — 0.9.4.1 and earlier 0.9.5 November 10, 2016
WF-eb367998-5c5c-4c4d-81cb-519023f028e6 High 7.2 — 0.9.4.1 and earlier 0.9.5 September 26, 2016
WF-d20eb274-e578-445f-95f4-5e677d9ad7f3 Medium 6.1 — 0.9.7.3 and earlier 0.9.7.4 May 7, 2019
WF-3b8282a2-8265-4fa0-b137-6272b9e44fc3 Medium 6.1 — 0.9.4.1 and earlier 0.9.5 July 29, 2016
CVE-2024-12006 Medium 5.3 0.5% Before 2.8.2 2.8.2 January 14, 2025
CVE-2026-66695 Medium 5.3 0.3% 2.10.2 and earlier 2.10.3 July 31, 2026
WF-b19ce745-2cc4-48eb-b5f3-5011be7cceec Medium 5.4 — 0.9.7.3 and earlier 0.9.7.4 May 22, 2019
WF-ddd2c5d9-6489-4154-a494-20392f435bc6 Medium 4.9 — 0.9.4.1 and earlier 0.9.5 September 26, 2016
CVE-2026-39595 Medium 4.3 0.2% 2.9.1 and earlier 2.9.2 March 12, 2026
WF-b002d1a1-a536-4865-b263-594390941ed4 Medium 4.3 — 0.9.7.3 and earlier 0.9.7.4 May 7, 2019
WF-a07bc541-2113-43db-acdf-9ecb00dd50e9 Low 3.7 — 0.9.4.1 and earlier 0.9.5 September 26, 2016

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.