CVE-2021-24308: 
WordPress vulnerability analysis and mitigation

CVE-2021-24308 affects the LifterLMS WordPress plugin versions before 4.21.1. The vulnerability was discovered in the 'State' field of the Edit profile page, where improper sanitization in the About section led to a stored Cross-Site Scripting (XSS) vulnerability (WPScan, NVD).

The vulnerability is classified as a stored Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 Base Score of 5.4 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability exists in the State field of the Edit profile page where user input is not properly sanitized before being displayed in the About section of the profile page (NVD, WPScan).

This vulnerability allows low privilege users (such as students) to potentially elevate their privileges through an XSS attack when an administrator views their profile. The XSS payload is triggered both in the public profile view and in the admin dashboard when viewing user details (WPScan).

The vulnerability has been fixed in version 4.21.1 of the LifterLMS plugin. Users are advised to update to this version or later to mitigate the security risk (Github Release).