CVE-2014-8724
Last modified
CVE-2014-8724 is a vulnerability of currently unknown severity. Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATH_INFO to the default URI.. EPSS estimates a 2.05% chance of exploitation in the next 30 days.
Description
Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATH_INFO to the default URI.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Boldgrid | W3 Total Cache | <= 0.9.4 |
References
- https://wordpress.org/plugins/w3-total-cache/changelog/Vendor Advisory
- https://wordpress.org/plugins/w3-total-cache/changelog/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-8724?
How severe is CVE-2014-8724?
How do I fix CVE-2014-8724?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-8712The build_expert_data function in epan/dissectors/packet-ncp…
- CVE-2014-8713Stack-based buffer overflow in the build_expert_data functio…
- CVE-2014-8714The dissect_write_structured_field function in epan/dissecto…
- CVE-2014-8716The JPEG decoder in ImageMagick before 6.8.9-9 allows local …
- CVE-2014-8722GetSimple CMS 3.3.4 allows remote attackers to obtain sensit…
- CVE-2014-8723GetSimple CMS 3.3.4 allows remote attackers to obtain sensit…
- CVE-2014-8727Multiple directory traversal vulnerabilities in F5 BIG-IP be…
- CVE-2014-8728SQL injection vulnerability in the login page (login/login) …
- CVE-2014-8730The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10…
- CVE-2014-8731PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers …
- CVE-2014-8732Cross-site scripting (XSS) vulnerability in phpMemcachedAdmi…
- CVE-2014-8733Cloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bin…
Are you affected by CVE-2014-8724?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST