CVE-2021-24436

The W3 Total Cache plugin prior to version 2.1.4 contained a reflected XSS flaw in the Extensions dashboard where the "extension" parameter was rendered into an HTML attribute without proper sanitization. An attacker could craft a malicious link that, when clicked by an authenticated administrator, would execute arbitrary JavaScript in the victim's browser, potentially enabling complete site takeover.

Based on public CVE data (MITRE/NVD).