CVE-2021-24275: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24275 affects the WordPress plugin 'Popup by Supsystic' versions prior to 1.10.5. It was discovered and publicly disclosed on April 19, 2021. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue that exists in the plugin's options page (WPScan).

The vulnerability stems from improper sanitization of the 'tab' parameter in the plugin's options page. When the parameter is output in an attribute, it can lead to a reflected Cross-Site Scripting condition. The vulnerability has been assigned a CVSS score of 7.1 (High) and is classified under CWE-79. The issue can be exploited through the WordPress admin panel at specific endpoints (WPScan).

If successfully exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in the context of the administrator's browser session. This could potentially lead to unauthorized actions being performed on behalf of the administrator or the theft of sensitive information (WPScan).

The vulnerability can be exploited through the WordPress admin interface by manipulating the 'tab' parameter in the URL. Proof of concept exploits have been documented, including '/wp-admin/admin.php?page=popup-wp-supsystic&tab="onmouseover=alert(1)//' and '/wp-admin/admin.php?page=popup-wp-supsystic&tab="+style=animation-name:rotation+onanimationstart=alert(/XSS)//' (WPScan).

The vulnerability has been patched in version 1.10.5 of the Popup by Supsystic plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).