CVE-2021-24436— W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-24436
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)
Source: NVD (National Vulnerability Database)
Vulnerability Description
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress和W3 Total Cache 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress是WordPress（Wordpress）基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。W3 Total Cache是一款网站缓存插件。 WordPress插件 W3 Total Cache 存在跨站脚本漏洞，该漏洞源于在扩展仪表板的“扩展”参数中，它以一个属性的形式输出，没有首先被转译。这可能会让攻击者可利用该漏洞在用户的web浏览器中运行恶意JavaScript，从而导致整个站点被破坏。攻击者可利用该漏洞可以说服经过认证的管理员点
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| BoldGrid | W3 Total Cache | 2.1.4 ~ 2.1.4 | - |
II. Public POCs for CVE-2021-24436
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | WordPress W3 Total Cache plugin before 2.1.4 is susceptible to cross-site scripting within the extension parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This can allow an attacker to convince an authenticated admin into clicking a link to run malicious JavaScript within the user's web browser, which could lead to full site compromise. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24436.yaml | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-24436
请登录查看更多情报信息。
- https://wpscan.com/vulnerability/05988ebb-7378-4a3a-9d2d-30f8f58fe9efx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2021-24436
IV. Related Vulnerabilities
Same product: W3 Total Cache
- CVE-2026-5032
W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exp - CVE-2026-27384
WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Ex - CVE-2025-9501
W3 Total Cache < 2.8.13 - Unauthenticated Command Injection - CVE-2024-12006
W3 Total Cache <= 2.8.1 Missing Authorization to Unauthentic - CVE-2024-12008
W3 Total Cache <= 2.8.1 Information Exposure via Log Files
Same vendor: BoldGrid
- CVE-2026-3143
Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenti - CVE-2026-39562
WordPress Client Invoicing by Sprout Invoices plugin <= 20.8 - CVE-2026-5032
W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exp - CVE-2026-32484
WordPress weForms plugin <= 1.6.26 - PHP Object Injection vu - CVE-2026-32424
WordPress Sprout Clients plugin <= 3.2.2 - Cross Site Script
Same weakness: CWE-79
- CVE-2026-8262
Devs Palace ERP Online chart-save cross site scripting - CVE-2026-8256
Devs Palace ERP Online mr-save cross site scripting - CVE-2026-8255
Devs Palace ERP Online add_new_customer cross site scripting - CVE-2026-8254
Devs Palace ERP Online sales_save cross site scripting - CVE-2026-8253
Devs Palace ERP Online purchase_save cross site scripting
V. Comments for CVE-2021-24436
No comments yet