CVE-2021-24246: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24246 affects the Workscout Core WordPress plugin versions before 1.3.4, which is used by the WorkScout Theme. The vulnerability was discovered and publicly disclosed on April 8, 2021. The issue stems from improper sanitization of chat messages sent through the workscout_send_message_chat AJAX action (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) and Cross-Frame Scripting (XFS) issue. It has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

The vulnerability allows authenticated attackers to store and execute malicious scripts through chat messages, potentially affecting other users who view these messages. This could lead to the theft of sensitive information or manipulation of the user interface (WPScan).

The vulnerability requires authentication to exploit, as it involves sending malicious payloads through the chat system. Proof of concept exploits have been documented, demonstrating the ability to inject both JavaScript and embedded content through the chat message functionality (WPScan).

The vulnerability has been fixed in WorkScout Core version 1.3.4 and WorkScout Theme version 2.0.33. Users are advised to update to these or later versions to mitigate the security risk (WPScan).