CVE-2021-24205: 
WordPress vulnerability analysis and mitigation

CVE-2021-24205 is a Cross-Site Scripting (XSS) vulnerability discovered in the Elementor Website Builder WordPress plugin versions before 3.1.4. The vulnerability was identified on January 14, 2021, and publicly disclosed on March 17, 2021. The issue affects the icon box widget functionality within the plugin, which is used by over 7 million WordPress sites (WPScan, Wordfence).

The vulnerability exists in the icon box widget (includes/widgets/icon-box.php) which accepts a 'title_size' parameter. While the element control specifies a fixed set of possible HTML tags, users with Contributor or higher permissions can bypass this restriction by sending a modified 'save_builder' request containing JavaScript in the 'title_size' parameter. The parameter is neither filtered nor properly escaped before output, leading to stored XSS. The vulnerability has been assigned a CVSS score of 6.4 (medium) and is classified as CWE-79 (WPScan).

When exploited, this vulnerability allows authenticated users with Contributor or higher permissions to inject malicious JavaScript code that executes when the affected page is viewed or previewed by other users. This could potentially lead to unauthorized actions being performed on behalf of other users who view the compromised page (WPScan).

The vulnerability requires an authenticated user with at least Contributor-level permissions to exploit. A proof of concept exists demonstrating how an attacker can inject JavaScript code through the 'title_size' parameter in a 'save_builder' request (WPScan).

The vulnerability has been fixed in Elementor version 3.1.4. Site administrators are strongly advised to update to this version or later to protect against this security issue (WPScan).