CVE-2021-24256: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24256 affects the 'Elementor – Header, Footer & Blocks Template' WordPress Plugin versions before 1.5.8. This security flaw was discovered and publicly disclosed on April 13, 2021. The vulnerability allows lower-privileged users, such as contributors, to perform stored Cross-Site Scripting (XSS) attacks through two different widgets in the plugin (WPScan).

The vulnerability exists in two widgets: the 'Page Title' and 'Site Title' widgets. In the 'Page Title' widget, attackers can exploit the 'heading_tag' parameter by sending a 'save_builder' request with the parameter set to 'script' and injecting JavaScript code in the page title. Additionally, attackers can set the 'heading_tag' to 'script' and manipulate the 'size' parameter to load remote malicious JavaScript files. The 'Site Title' widget is vulnerable to similar exploitation methods. The vulnerability has been assigned a CVSS score of 6.8 (medium severity) (WPScan).

When successfully exploited, this vulnerability allows attackers with contributor-level access to inject and execute malicious JavaScript code that will be triggered when other users view or preview the affected pages. This can lead to various malicious activities including theft of sensitive information, session hijacking, or manipulation of page content (Wordfence).

The vulnerability can be exploited by users with contributor-level access or higher privileges. The attack vector involves manipulating the 'heading_tag' and 'size' parameters in the affected widgets to inject malicious JavaScript code or load remote malicious scripts (WPScan).

The vulnerability has been patched in version 1.5.8 of the Elementor – Header, Footer & Blocks Template plugin. Website administrators are strongly advised to update to this version or later to protect against potential attacks (WPScan).