CVE-2021-24452CWE-79

W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)

published July 19, 2021

CVSS
—
EPSS
2%
Percentile
79.7
In the wild
Unconfirmed
What it is

The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01917 · 79.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-07-19T10:53Z
EPSS history
Timeline
  • 19 JUL 10:53Z
    W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)
    cvelistv5