Medium severity4.8NVD Advisory· Published Jul 12, 2021· Updated Jun 17, 2026

CVE-2021-24427

Description

The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page, leading to an authenticated Stored Cross-Site Scripting issue

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Boldgrid/W3 Total Cache2 versions
cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:wordpress:*:*+ 1 more
- cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:wordpress:*:*range: <2.1.3
- (no CPE)range: 2.1.3
WordPress/W3 Total Cachellm-fuzzy
Range: <2.1.3
Package: https://wordpress.org/plugins/w3-total-cache

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/5da5ce9a-82a6-404f-8dec-795d7905b3f9nvdExploitThird Party Advisory
m0ze.ru/vulnerability/%5B2021-04-25%5D-%5BWordPress%5D-%5BCWE-79%5D-W3-Total-Cache-WordPress-Plugin-v2.1.2.txtnvd

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000