CVE-2021-24452 - CVE House
Back to Database
Status published Medium CVE-2021-24452

W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)

Vulnerability Description

The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-24452

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • renniepak

References

More from BoldGrid

View All →
CVE-2025-69345
WordPress Post and Page Builder by BoldGrid plugin <= 1.27.9 - Broken Access Control vulnerability
Medium 4.3
CVE-2025-69028
WordPress weForms plugin <= 1.6.25 - Broken Access Control vulnerability
Medium 5.3
CVE-2025-66118
WordPress Sprout Clients plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability
High 7.1
CVE-2025-64229
WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - Broken Access Control vulnerability
Medium 4.3
CVE-2025-64227
WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability
Critical 9.8

Affected Vendor

Affected Software

W3 Total Cache
Vulnerable Versions:
2.1.5

Timeline

Official Publish: July 19th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact