CVE-2021-24134: 
WordPress vulnerability analysis and mitigation

Multiple stored cross-site scripting (XSS) vulnerabilities were discovered in Constant Contact Forms for WordPress versions 1.8.7 and lower. The vulnerability, tracked as CVE-2021-24134, affects high-privileged users (Editor+) who can inject arbitrary Javascript code or HTML in posts where the malicious form is embedded (WPScan).

The vulnerability exists in the Add New Form's form parameters, specifically in the 'Button text' and 'Field Description' fields. When an attacker with Editor or higher privileges inputs malicious XSS vectors into these fields, the stored script is executed for all users visiting the website where the form is embedded via shortcodes (e.g., [ctct form="XXX"]). The vulnerability has been assigned a CVSS score of 4.8 (medium) and is classified under CWE-79 (WPScan).

When successfully exploited, the vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browsers who visit pages containing the compromised form. This could potentially lead to session hijacking, defacement, or theft of sensitive browser data from users viewing the affected pages (WPScan).

The vulnerability requires an authenticated user with Editor or higher privileges to exploit. The attacker needs to create or edit a form and inject malicious JavaScript code into either the Button text or Field Description fields. The exploit is then triggered when any user visits a page where the compromised form is embedded (WPScan).

The vulnerability has been patched in version 1.8.8 of the Constant Contact Forms plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).