PULSE
ES
FEED
ransomrhysida reclama a Sanders Law Group · Professional Servicesransomqilin reclama a Miljaus Producciones S.L (www.miljaus.com) · ES · Otherransomqilin reclama a von Schaewen · DE · Otherransomn0n reclama a Company #110 · ES · Not Foundransomchaos reclama a mickeybody.com · US · Retail & E-Commerceransomaurora reclama a ARX Group SA · CH · Otherransomwhitearmor reclama a whitearmor.cc · Technologyransomlockbit5 reclama a dorsiacademy.it · IT · Educationransomlockbit5 reclama a mlh.com.lb · LB · Professional Servicesransomlockbit5 reclama a lidoway.com · LI · Not Foundransomlockbit5 reclama a zelsior.es · ES · Not Foundransomemperador reclama a JS Constructor, INC · US · Manufacturingransomwhitearmor reclama a Whirlpool · US · Manufacturingransomwhitearmor reclama a JB Hunt · US · Transportationransomrhysida reclama a Sanders Law Group · Professional Servicesransomqilin reclama a Miljaus Producciones S.L (www.miljaus.com) · ES · Otherransomqilin reclama a von Schaewen · DE · Otherransomn0n reclama a Company #110 · ES · Not Foundransomchaos reclama a mickeybody.com · US · Retail & E-Commerceransomaurora reclama a ARX Group SA · CH · Otherransomwhitearmor reclama a whitearmor.cc · Technologyransomlockbit5 reclama a dorsiacademy.it · IT · Educationransomlockbit5 reclama a mlh.com.lb · LB · Professional Servicesransomlockbit5 reclama a lidoway.com · LI · Not Foundransomlockbit5 reclama a zelsior.es · ES · Not Foundransomemperador reclama a JS Constructor, INC · US · Manufacturingransomwhitearmor reclama a Whirlpool · US · Manufacturingransomwhitearmor reclama a JB Hunt · US · Transportation
← All CVEs
CVE WatchOct 19, 2026

CVE-2025-9501

The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthe

CVSS

9.0

Critical

EPSS

22.1%

p98

KEV

—

Exploit Today

29

0-100

Published: Nov 17, 2025 · Last modified: Oct 19, 2026

EPSS · 30d
20.5%EPSS · 30 days22.6%
2026-09-252026-10-23
Technical description

The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.

Official references
Related CVEs

No related CVEs by CWE or product.