CVE-2021-24436: W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)

Q: What is the vulnerability ID for the W3 Total Cache WordPress plugin?

The vulnerability ID for the W3 Total Cache WordPress plugin is CVE-2021-24436.

Q: What is the severity of CVE-2021-24436?

The severity of CVE-2021-24436 is medium (6.1).

Q: What is the affected software for CVE-2021-24436?

The affected software for CVE-2021-24436 is the W3 Total Cache WordPress plugin version up to 2.1.4 by Boldgrid.

Q: What is the CWE ID for CVE-2021-24436?

The CWE ID for CVE-2021-24436 is CWE-79.

Q: How can I fix the CVE-2021-24436 vulnerability?

To fix the CVE-2021-24436 vulnerability, update the W3 Total Cache WordPress plugin to version 2.1.4 or higher.

Published Jul 19, 2021

Updated

The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.

Affected Software

1 affected component

BoldGrid W3 Total Cache Wordpress<2.1.4

Event History

Jul 19, 2021

CVE Published

via MITRE·10:53 AM

Data Sourced

via MITRE·10:53 AM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID for the W3 Total Cache WordPress plugin?

The vulnerability ID for the W3 Total Cache WordPress plugin is CVE-2021-24436.

What is the severity of CVE-2021-24436?

The severity of CVE-2021-24436 is medium (6.1).

What is the affected software for CVE-2021-24436?

The affected software for CVE-2021-24436 is the W3 Total Cache WordPress plugin version up to 2.1.4 by Boldgrid.

What is the CWE ID for CVE-2021-24436?

The CWE ID for CVE-2021-24436 is CWE-79.

How can I fix the CVE-2021-24436 vulnerability?