WordPress CVEs

Description

Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATH_INFO to the default URI.

Affected WordPress components

• W3 Total Cache Plugin · w3-total-cache
  Confirmed match Active
  Versions not specified
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• boldgrid w3_total_cache — Up to and including 0.9.4

References

• packetstormsecurity.com http://packetstormsecurity.com/files/129626/W3-Total-Cache-0.9.4-Cross-Site-Scripting.html Exploit
• www.securityfocus.com http://www.securityfocus.com/archive/1/534266/100/0/threaded
• wordpress.org https://wordpress.org/plugins/w3-total-cache/changelog/ Vendor Advisory
• www.secuvera.de https://www.secuvera.de/advisories/secuvera-SA-2014-01.txt Exploit
• nvd.nist.gov Official NVD record