CVE-2021-20746: 
WordPress vulnerability analysis and mitigation

Cross-site scripting (XSS) vulnerability was discovered in WordPress Popular Posts plugin version 5.3.2 and earlier. The vulnerability was identified and reported by Yu Iwama of Secure Sky Technology Inc. through JPCERT/CC Vulnerability Coordination Group. The issue affects authenticated users with administrative privileges who could potentially inject arbitrary scripts via unspecified vectors (JVN Report, WPScan).

The vulnerability exists in the Default Thumbnail setting of the plugin, which failed to properly sanitize or escape input before outputting it back in the page, leading to a stored Cross-Site Scripting issue. The CVSS v3.0 base score is 5.4 (medium), with the vector string CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability requires the attacker to have authenticated access with administrative privileges (JVN Report, WPScan).

If exploited, the vulnerability could allow an authenticated attacker with administrative privileges to inject and execute arbitrary JavaScript code in the context of other users' browsers who visit the affected pages (JVN Report).

The vulnerability requires authentication and administrative privileges to exploit. A proof of concept exists demonstrating that the vulnerability can be triggered through the plugin's Default Thumbnail setting in the WordPress admin panel (WPScan).

The vulnerability was patched in WordPress Popular Posts version 5.3.3. Users are strongly advised to update to this version or later to mitigate the security risk. The fix includes proper input sanitization and validation for the affected functionality (Developer Blog).