CVE-2021-24266: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24266 affects 'The Plus Addons for Elementor Page Builder Lite' WordPress Plugin versions before 2.0.6. This security issue was discovered and publicly disclosed on April 13, 2021, involving stored Cross-Site Scripting (XSS) vulnerabilities that could be exploited by lower-privileged users such as contributors (WPScan).

The vulnerability consists of four widgets that are susceptible to stored XSS attacks through similar methods. The affected widgets include 'Accordion' (via title_html_tag parameter), 'Infobox' (via title_tag parameter), 'Heading animation' (via ani_title_tag parameter), and 'Hovercard' (via open_tag parameter). In each case, while the element control lists fixed HTML tag options, attackers can send a 'save_builder' request containing JavaScript in these parameters, which are neither filtered nor escaped properly. The vulnerability has a CVSS score of 6.8 (medium severity) and is classified under CWE-79 (WPScan).

When exploited, the vulnerability allows malicious JavaScript code to be stored and executed when the saved page is viewed or previewed by other users. This could potentially lead to unauthorized actions being performed on behalf of other users who view the affected pages (WPScan).

The vulnerability can be exploited by users with contributor-level access or higher privileges. The attack vector requires the ability to create or edit pages using the Elementor page builder with The Plus Addons plugin (WPScan).

The vulnerability has been patched in version 2.0.6 of The Plus Addons for Elementor Page Builder Lite. Users are advised to update to this version or later to mitigate the security risk (WPScan, Wordfence).