The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the \extension\ parameter in the Extensions dashboard when the 'Anonymously track usage to improve product quality' setting is enabled as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker who can convince an authenticated admin into clicking a link to run malicious JavaScript within the user's web browser which could lead to full site compromise.