CVE-2021-24301: 
WordPress vulnerability analysis and mitigation

The Hotjar Connecticator WordPress plugin through version 1.1.1 contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'hotjar script' textarea field. The vulnerability requires administrator privileges to exploit and includes proper CSRF nonce verification (WPScan Advisory).

The vulnerability is classified as a Stored XSS (CWE-79) with a CVSS v3.1 Base Score of 5.4 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The issue exists in the 'hotjar script' textarea where malicious JavaScript can be injected and stored, which executes when users visit the website (NVD).

When exploited, the vulnerability allows authenticated administrators to store and execute arbitrary JavaScript code that affects users visiting the website. While the attack requires administrator privileges, it could potentially impact all site visitors (WPScan Advisory).

At the time of disclosure, there was no known fix available for this vulnerability. Users should consider either removing the plugin or implementing additional security controls to restrict access to the administrative interface (WPScan Advisory).