CVE-2021-24277: 
WordPress vulnerability analysis and mitigation

The RSS for Yandex Turbo WordPress plugin before version 1.30 contained a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and disclosed in April 2021, affecting the plugin's Счетчики settings tab where user inputs were not properly sanitized before being stored and displayed back to users (WPScan).

The vulnerability exists due to improper sanitization of user inputs in the Счетчики (Counters) settings tab. The affected fields include Яндекс.Метрика, LiveInternet, Google Analytics, Рейтинг Mail.Ru, Rambler Топ-100, and Mediascope (TNS). The vulnerability has been assigned a CVSS score of 6.6 (medium) and is classified as CWE-79 (WPScan).

The vulnerability allows authenticated users to store and execute malicious JavaScript code that would execute when other users access the affected pages. When triggered, the stored XSS payload could potentially allow attackers to perform actions in the context of other users' sessions, steal sensitive information, or manipulate the website's content (WPScan).

The vulnerability was fixed in version 1.30 of the RSS for Yandex Turbo plugin. Users are advised to update to this version or later to protect against this security issue (WPScan).