.. / CVE-2021-24452

• XSS
• Nuclei
• Web

Exploit for WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting (CVE-2021-24452)

Description:

WordPress W3 Total Cache plugin before 2.1.5 is susceptible to cross-site scripting via the extension parameter in the Extensions dashboard, when the setting ‘Anonymously track usage to improve product quality’ is enabled. The parameter is output in a JavaScript context without proper escaping. This can allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user’s web browser, which could lead to full site compromise.

Nuclei Template

View the template here CVE-2021-24452.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-24452.yaml

References: