CVE-2021-24228: 
WordPress vulnerability analysis and mitigation

The Patreon WordPress plugin versions below 1.7.2 contained a Reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24228. The vulnerability was discovered by the Jetpack Scan team and publicly disclosed on March 26, 2021. The issue affected the WordPress login form (wp-login.php) functionality that allows users to authenticate using their Patreon account (WPScan, Jetpack Blog).

The vulnerability stems from unsanitized user-controlled input in the error logging logic that was reflected on the login page. The security flaw received a CVSS score of 8.8 (high severity) and is classified under CWE-79. The vulnerability was identified as part of the OWASP Top 10 under A7: Cross-Site Scripting (XSS) category (WPScan).

If successfully exploited, an attacker could execute arbitrary JavaScript code in the victim's browser context. When targeting an administrator account, this vulnerability could lead to complete site takeover, as the malicious code would run with the victim's privileges (Jetpack Blog).

To exploit this vulnerability, an attacker needs to craft a malicious link containing JavaScript code and trick a user into clicking it. The attack is particularly dangerous when targeting administrative users, as it could result in full site compromise (WPScan).

The vulnerability was patched in version 1.7.2 of the Patreon WordPress plugin. Site administrators are strongly advised to update to this version or later to protect against this security risk (Jetpack Blog).