w3
Security Risk Profile
58
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 11 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from January 28, 2009 to present
11
Total CVEs
6
Critical+High
0
Exploited
4
Unpatched
Threat Assessment
Avg CVSS
7.3
Base severity
Avg EPSS
2%
Exploit probability
Unpatched
4
Critical/High
Risk Level
58/100
medium
Severity Distribution
Critical
3High
3Medium
3Low
1Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
1Age Distribution
Common Weaknesses (CWE)
1
XEE
2
2
XSS
2
3
Buffer Overflow
2
4
OS Command Injection
1
5
Command Injection
1
Most Affected Products
1. W3 Amaya72
2. W3 Total Cache2
3. W3C W3CSS Validator1
4. W3 CSS Validator1
5. W3 Download Manager1
Recent Vulnerabilities
See more →https://www.bleepingcomputer.com/news/security/w3-total-cache-wordpress-plugin-vulnerable-to-php-command-injection/
unknown
W3 Total Cache WordPress plugin vulnerable to PHP command injection
11/19/2025🔧 No Patch
CVE-2025-9501
CVSS 9.0EPSS 2%critical
W3 Total Cache < 2.8.13 - Unauthenticated Command Injection
11/17/2025🔧 No Patch
CVE-2025-1781
CVSS 8.4high
3/28/2025🔧 No Patch
CVE-2024-32131
CVSS 7.5high
WordPress Download Manager plugin <= 3.2.82 - File Password Lock Bypass vulnerability
5/17/2024
CVE-2014-125108
CVSS 6.1medium
w3c online-spellchecker-py spellchecker cross site scripting
12/23/2023
CVE-2023-30300
CVSS 5.5medium
5/3/2023🔧 No Patch
CVE-2021-4296
CVSS 6.1medium
w3c Unicorn ValidatorNuMessage.java ValidatorNuMessage cross site scripting
12/29/2022
CVE-2016-9487
CVSS 7.8high
EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks
7/13/2018
CVE-2017-5928
CVSS 3.7low
2/27/2017🔧 No Patch
CVE-2009-1209
CVSS 9.3critical
4/1/2009🔧 No Patch
Monitor w3 in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.