WordPress W3 Total Cache plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. A cross-site scripting vulnerability exists in the WordPress plugin W3 Total Cache in versions prior to 2.1.4, which stems from a lack of validation of client-side data in the “extension” parameter of the extension dashboard. and the lack of escaping or entity encoding in the output. An attacker could use this vulnerability to trick users into clicking through to execute client-side code to steal user cookie credentials.