Skip to content
PluginCanary

W3 Total Cache

by BoldGrid · 900,000+ active installs · Checked 3 Nov 2026
Healthy8 Warnings

Healthy: vulnerability published 30 Oct 2026, fixed in 2.11.0.

80/ 100 Canary Score
Sub-scores for W3 Total Cache
Ownership100
Maintenance100
Security60
Support62
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 2.11.0. Update to version 2.11.0 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 2.11.0. Update to version 2.11.0 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 22 Oct 2026, fixed in 2.11.0. Update to version 2.11.0 or later.22 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 8 Oct 2026, fixed in 2.10.6. Update to version 2.10.6 or later.8 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 1 Oct 2026, fixed in 2.10.7. Update to version 2.10.7 or later.1 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 4 Sep 2026, fixed in 2.10.6. Update to version 2.10.6 or later.4 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 21 Aug 2026, fixed in 2.10.5. Update to version 2.10.5 or later.21 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 13 Aug 2026, fixed in 2.10.4. Update to version 2.10.4 or later.13 Aug 2026Evidence
  • InfoSEC-318 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
fredericktownes1 Aug 2009 to 21 Nov 2019, 338 commits
boldgrid18 Dec 2019 to 20 Oct 2026, 409 commits
joemoto31 Mar 2020 to 4 Sep 2026, 83 commits

3 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
14 days ago
Releases, 24 months
31
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for W3 Total Cache
Q1 20241
Q2 20243
Q3 20244
Q4 20244
Q1 20255
Q2 20253
Q3 20252
Q4 20253
Q1 20266
Q2 20261
Q3 20266
Q4 20262

Last release 20 Oct 2026. Tested with WordPress 7.1 (current).

Support

62% of 13 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder5.4<= 2.10.72.11.00
30 Oct 2026W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry7.2<= 2.10.72.11.00
22 Oct 2026W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting7.2<= 2.10.72.11.00
8 Oct 2026W3 Total Cache <= 2.10.5 - Authenticated (Author+) Path Traversal6.5<= 2.10.52.10.60
1 Oct 2026W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2<= 2.10.62.10.70
4 Sep 2026W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator7.2<= 2.10.52.10.60
21 Aug 2026W3 Total Cache < 2.10.5 - Unauthenticated Path Traversal7.5< 2.10.52.10.50
13 Aug 2026W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name7.2<= 2.10.32.10.40
31 Jul 2026W3 Total Cache <= 2.10.2 - Unauthenticated Path Traversal5.3<= 2.10.22.10.30
10 Jul 2026W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter7.5<= 2.9.42.10.00
29 Jun 2026W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary Code Execution8.1<= 2.9.42.10.00
1 Apr 2026W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header7.5<= 2.9.32.9.40
12 Mar 2026W3 Total Cache <= 2.9.1 - Missing Authorization4.3<= 2.9.12.9.20
24 Feb 2026W3 Total Cache <= 2.9.1 - Unauthenticated Arbitrary Code Execution9.8<= 2.9.12.9.210
27 Oct 2025W3 Total Cache <= 2.8.12 - Unauthenticated Command Injection8.1<= 2.8.122.8.130
13 Jan 2025W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery8.5<= 2.8.12.8.20
13 Jan 2025W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation5.3<= 2.8.12.8.20
13 Jan 2025W3 Total Cache <= 2.8.1 Information Exposure via Log Files5.3<= 2.8.12.8.20
23 Sep 2024W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext3.7<= 2.7.52.7.61
20 Jun 2022Guzzle <= 6.5.7 and 7.0-7.4.4 - Information Exposure7.7<= 2.2.22.2.310
28 Jun 2021W3 Total Cache <= 2.1.3 - Reflected Cross-Site Scripting via extension6.1< 2.1.42.1.40
28 Jun 2021W3 Total Cache <= 2.1.4 - Reflected Cross-Site Scripting via extension7.20.5 to 2.1.42.1.50
16 Jun 2021W3 Total Cache <= 2.1.2 Authenticated (Admin+) Stored Cross-Site Scripting4.8< 2.1.32.1.30
22 Dec 2020W3 Total Cache 0.9.2.6-0.9.3 - File Read / Directory Traversal7.50.9.2.6 to 0.9.30.9.40
22 Sep 2020W3 Total Cache <= 0.9.2.4 - Sensitive Information Exposure7.5<= 0.9.2.40.9.2.50

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for W3 Total Cache
Q1 20252.6
Q2 20253.5
Q3 20253.7
Q4 20251.0
Q1 20263.2
Q2 20263.7
Q3 20265.0

Average rating rose from 2.6 to 5.0 between Q1 2025 and Q3 2026.

Rating distribution
5 star4057
4 star585
3 star160
2 star102
1 star516
Latest low reviews

Momentum

900,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for W3 Total Cache
4 May 202622,135
11 May 202644,425
18 May 202653,969
25 May 202637,480
1 Jun 202633,708
8 Jun 202634,660
15 Jun 202632,398
22 Jun 2026298,714
29 Jun 202695,140
6 Jul 2026358,744
13 Jul 2026347,955
20 Jul 202698,273
27 Jul 2026352,589
3 Aug 2026364,913
10 Aug 2026376,433
17 Aug 202682,776
24 Aug 202659,592
31 Aug 2026319,527
7 Sep 202699,438
14 Sep 202674,452
21 Sep 202662,269
28 Sep 2026315,899
5 Oct 2026117,797
12 Oct 202655,787
19 Oct 2026366,855
26 Oct 2026108,861
2 Nov 202611,102

Weekly downloads over the last 4 weeks are 13% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Super Page Cache - Cloudflare Cache, Page Speed & Core Web VitalsScore 95 · 70,000+WP Super CacheScore 93 · 1,000,000+Nginx HelperScore 91 · 200,000+SpinupWPScore 91 · 30,000+Instant Back/ForwardScore 91 · 10,000+

Facts

Version2.11.0
AuthorBoldGrid
Added29 Jul 2009
Last updated20 Oct 2026
Active installs900,000+
Requires WordPress6.0
Tested up to7.1.4
Requires PHP7.4
CategoryPerformance & Optimization > Caching Solutions
Tagscdn, caching, Optimize, pagespeed, performance

Other plugins by this author: Post and Page Builder by BoldGrid - Visual Drag and Drop Editor, BoldGrid Easy SEO - Simple and Effective SEO, Total Upkeep - WordPress Backup Plugin plus Restore & Migrate by BoldGrid, weForms - Easy Drag & Drop Contact Form Builder For WordPress, Map Block, Sprout Invoices - Client Invoicing & Estimates, Help Scout, WP Forms + Sprout Invoices - Easy Invoice & Quote Submissions, Formidable Forms + Sprout Invoices - Easy Invoice & Estimate Submissions, Gravity Forms + Sprout Invoices - Easy Invoice & Estimate Submissions, Ninja Forms + Sprout Invoices - Easy Invoice & Estimate Submissions, Sprout Clients - CRM and Lead Management

Questions

Is W3 Total Cache still maintained?

W3 Total Cache was last updated on 20 Oct 2026. Its Canary status is Healthy.

Is W3 Total Cache safe?

W3 Total Cache has no open unpatched vulnerabilities on record. 18 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns W3 Total Cache?

The wordpress.org author is BoldGrid. Recent committers: boldgrid, joemoto, fredericktownes, barry, plugin-master. We have recorded no ownership change.

What can I use instead of W3 Total Cache?

Plugins in the same category with a higher Canary Score: Super Page Cache - Cloudflare Cache, Page Speed & Core Web Vitals, WP Super Cache, Nginx Helper, SpinupWP, Instant Back/Forward.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue