Vulnerability Description
The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Boldgrid | W3 Total Cache | < 2.1.5 |
Related Weaknesses (CWE)
References
- https://wpscan.com/vulnerability/3e855e09-056f-45b5-89a9-d644b7d8c9d0ExploitThird Party Advisory
- https://wpscan.com/vulnerability/3e855e09-056f-45b5-89a9-d644b7d8c9d0ExploitThird Party Advisory
FAQ
What is CVE-2021-24452?
CVE-2021-24452 is a vulnerability with a CVSS score of 6.1 (MEDIUM). The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track ...
How severe is CVE-2021-24452?
CVE-2021-24452 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-24452?
Check the references section above for vendor advisories and patch information. Affected products include: Boldgrid W3 Total Cache.