Now officially on WordPress.org

CVE Database / CVE-2014-8724

CVE

CVE-2014-8724 — W3 Total Cache [w3-total-cache] < 0.9.4.1

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2014-8724 W3 Total Cache [w3-total-cache] < 0.9.4.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Unknown < 0.9.4.1 0.9.4.1 2014-11-10 —

CVE-2014-8724

The W3 Total Cache plugin before version 0.9.4.1 contains a stored cross-site scripting flaw that can be exploited when debug mode is active. An attacker can inject malicious scripts or HTML code through the Cache key parameter in HTML comments, with the vulnerability demonstrated via PATH_INFO manipulation in the default URI. This allows remote adversaries to execute arbitrary code in the context of affected WordPress installations.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings