Medium severity6.1NVD Advisory· Published Jul 19, 2021· Updated Jun 17, 2026
CVE-2021-24436
CVE-2021-24436
Description
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:wordpress:*:*+ 1 more
- cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:wordpress:*:*range: <2.1.4
- (no CPE)range: 2.1.4
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/05988ebb-7378-4a3a-9d2d-30f8f58fe9efnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.