CVE-2021-24283: 
WordPress vulnerability analysis and mitigation

CVE-2021-24283 is a Reflected Cross-Site Scripting (XSS) vulnerability discovered in the WordPress Accordion plugin versions below 2.2.30. The vulnerability was identified and disclosed on April 21, 2021. The issue specifically affects the plugin's settings page, where the tab GET parameter is not properly sanitized or escaped when being output in an HTML attribute (WPScan).

The vulnerability is classified as a Reflected Cross-Site Scripting (XSS) issue with a CVSS score of 7.1 (High). It is categorized under OWASP Top 10 as A7: Cross-Site Scripting (XSS) and has been assigned CWE-79. The vulnerability exists due to improper sanitization of the tab GET parameter in the settings page of the Accordion plugin (WPScan).

This authenticated XSS vulnerability could allow attackers with access to the WordPress admin panel to execute arbitrary JavaScript code in the context of other users' browsers who visit the specially crafted URL. This could potentially lead to theft of sensitive information or manipulation of the admin interface (WPScan).

The vulnerability requires authentication to exploit, meaning an attacker must have at least subscriber-level access to the WordPress installation. Proof of concept URLs have been documented for versions below 2.2.29 and 2.2.30, demonstrating how the XSS payload can be triggered through the settings page (WPScan).

The vulnerability has been fixed in version 2.2.30 of the Accordion plugin. Users are advised to update to this version or later to mitigate the risk. No alternative workarounds have been published (WPScan).