CVE-2021-24136: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24136 affects the Testimonials Widget WordPress plugin versions before 4.0.0. It was discovered in May 2020 and publicly disclosed on July 3rd, 2020. The vulnerability stems from unvalidated input and lack of output encoding in multiple fields of the plugin (WPScan).

The vulnerability is classified as a Multiple Authenticated Stored Cross-Site Scripting (XSS) issue with a CVSS score of 5.5 (medium). The vulnerability exists in the templates folder where the plugin echoes user input values without proper sanitization. The affected parameters include Author, Job Title, Location, Company, Email, and URL fields. The vulnerability is tracked as CWE-79 and falls under the OWASP Top 10 category A7: Cross-Site Scripting (WPScan).

Successful exploitation of this vulnerability allows authenticated users with medium-level privileges (contributor or higher) to inject arbitrary JavaScript code or HTML. The injected script is executed for all users visiting the website. For contributors, the testimonials go through a manual review process before execution (WPScan).

The vulnerability can be exploited by authenticated users with contributor-level access or higher. The attack vector involves creating a new testimonial and injecting malicious JavaScript code or HTML through various input fields. The injected code is executed when users visit either the testimonial permalink or posts containing embedded testimonial shortcodes (WPScan).

The vulnerability was fixed in version 4.0.0 of the Testimonials Widget plugin, released on July 12th, 2020. Users are advised to update to this version or later to mitigate the vulnerability (WPScan).