CVE-2021-24436: vulnerability in BoldGrid W3 Total Cache
W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 1.8%
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
Affected products
BoldGrid · W3 Total CacheRelated CVEs — BoldGrid W3 Total Cache
In the same product, most dangerous first.
CVE-2021-24452—W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)EPSS 1.9%CVE-2021-24427—W3 Total Cache < 2.1.3 - Authenticated Stored XSSEPSS 0.6%CVE-2026-57623CRITICALWordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerabilityEPSS 0.5%CVE-2026-66695MEDIUMWordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerabilityEPSS 0.4%CVE-2026-27384CRITICALWordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerabilityEPSS 0.4%CVE-2026-39595MEDIUMWordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerabilityEPSS 0.2%