Back to Database
Status published
Medium
CVE-2021-24427
W3 Total Cache < 2.1.3 - Authenticated Stored XSS
Vulnerability Description
The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page, leading to an authenticated Stored Cross-Site Scripting issue
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-24427
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- m0ze
References
More from BoldGrid
View All →CVE-2025-69345
WordPress Post and Page Builder by BoldGrid plugin <= 1.27.9 - Broken Access Control vulnerability
Medium
4.3
CVE-2025-69028
WordPress weForms plugin <= 1.6.25 - Broken Access Control vulnerability
Medium
5.3
CVE-2025-66118
WordPress Sprout Clients plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability
High
7.1
CVE-2025-64229
WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - Broken Access Control vulnerability
Medium
4.3
CVE-2025-64227
WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability
Critical
9.8
Affected Vendor
BoldGrid
View all reports →Affected Software
W3 Total Cache
Vulnerable Versions:
2.1.3
Timeline
Official Publish:
July 12th, 2021
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N