CVE-2021-24300: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2021-24300) affects the PickPlugins Product Slider for WooCommerce WordPress plugin versions before 1.13.22. The issue was discovered and publicly disclosed on May 6, 2021. The vulnerability exists in the slider import search feature of the plugin settings, which failed to properly sanitize the keyword GET parameter (WPScan).

This is a Reflected Cross-Site Scripting (XSS) vulnerability with a CVSS score of 7.1 (high severity). The vulnerability is classified under CWE-79 and OWASP Top 10 category A7: Cross-Site Scripting. The issue can be exploited through the keyword GET parameter in the plugin's import layouts feature (WPScan).

If exploited, this vulnerability allows attackers to execute malicious JavaScript code in the context of other users' browsers who access the affected pages. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected user's session (WPScan).

The vulnerability has been fixed in version 1.13.22 of the PickPlugins Product Slider for WooCommerce plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).