blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24436

MEDIUM 6.1 CVSS 3.1
Published
July 19, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • BoldGrid W3 Total Cache — From 2.1.4 (including) to 2.1.4 (excluding)
  • boldgrid w3_total_cache — Before 2.1.4

References

  • wpscan.com https://wpscan.com/vulnerability/05988ebb-7378-4a3a-9d2d-30f8f58fe9ef Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record