CVE-2021-24297: 
NixOS vulnerability analysis and mitigation

The Goto WordPress theme before version 2.1 contains a security vulnerability identified as CVE-2021-24297. This vulnerability was discovered by Truoc Phan from Techlab Corporation and was publicly disclosed on May 4, 2021. The issue affects the WordPress theme 'Goto' in versions prior to 2.1 (WPScan).

The vulnerability is classified as an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability. The security flaw exists because the theme failed to properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX action. The vulnerability has been assigned a CVSS score of 7.1 (High) and is categorized under CWE-79 (WPScan).

This vulnerability allows unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks against users of the affected WordPress sites. As an XSS vulnerability, it could potentially enable attackers to execute malicious scripts in users' browsers, potentially leading to theft of sensitive information or manipulation of website content (WPScan).

The vulnerability can be exploited through a specially crafted POST request to the wp-admin/admin-ajax.php endpoint, utilizing the tl_filter AJAX action with malicious content in the formvalue parameter. A proof of concept exploit has been publicly documented (WPScan).

The vulnerability has been fixed in version 2.1 of the Goto WordPress theme. Users are advised to update to this version or later to mitigate the security risk (WPScan).