CVE-2021-24436 W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)

What is CVE-2021-24436?

CVE-2021-24436 is a medium-severity cross-site scripting vulnerability in BoldGrid W3 Total Cache, published on 19 Jul 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.

Weakness: CWE-79

Which versions are affected by CVE-2021-24436?

It affects 1 product.

Products include Boldgrid W3 Total Cache.

How do I fix CVE-2021-24436?

No fix has been published for CVE-2021-24436 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-24436 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-24436 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in BoldGrid W3 Total Cache

• CVE-2024-12365 W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery High 8.5
• CVE-2012-6077 Information disclosure in Total Cache High 7.5
• CVE-2012-6078 Information disclosure in Total Cache High 7.5
• CVE-2012-6079 Information disclosure in Total Cache High 7.5
• CVE-2019-6715 Path traversal in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8qcc-x8gh-5483.