CVE-2021-24327: 
WordPress vulnerability analysis and mitigation

The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin (versions before 7.1) contains a stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2021-24327. The vulnerability was discovered on April 16, 2021, and affects the plugin's redirect management functionality in the WordPress dashboard (WPScan).

The vulnerability stems from insufficient sanitization of the 'Redirect From' and 'Redirect To' fields when creating new redirects in the dashboard. This security flaw exists even when the unfiltered_html capability is disabled for high-privilege users. The vulnerability has been assigned a CVSS score of 3.5 (low severity) and is classified as CWE-79 (Cross-Site Scripting) (WPScan).

The vulnerability allows authenticated users with high privileges to inject and store XSS payloads through the redirect management interface. When triggered, these payloads could potentially execute malicious JavaScript code in users' browsers who access the affected areas of the WordPress admin dashboard (WPScan).

A proof of concept exists demonstrating the vulnerability exploitation. An attacker can create a new Custom redirect at /wp-admin/options-general.php?page=seo-redirection.php and set XSS payloads such as /">alert(/XSS/) in both the Redirect From and Redirect To fields (WPScan).

The vulnerability has been patched in version 7.1 of the SEO Redirection Plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).