CVE-2021-24436CWE-79

W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)

published July 19, 2021

CVSS
—
EPSS
2%
Percentile
79.6
In the wild
Unconfirmed
What it is

The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01905 · 79.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-07-19T10:53Z
EPSS history
Timeline
  • 19 JUL 10:53Z
    W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)
    cvelistv5