CVE-2021-24452

The W3 Total Cache plugin prior to version 2.1.5 contains a reflected cross-site scripting vulnerability in the Extensions dashboard. When the usage tracking feature is enabled, the "extension" parameter is rendered directly into JavaScript code without adequate sanitization. An attacker could craft a malicious link and trick an authenticated administrator into clicking it, potentially executing arbitrary JavaScript in the admin's browser and compromising the entire website.

Based on public CVE data (MITRE/NVD).