CVE-2021-24330: 
WordPress vulnerability analysis and mitigation

CVE-2021-24330 affects the Funnel Builder by CartFlows WordPress plugin versions before 1.6.13. The vulnerability was discovered and publicly disclosed on May 17, 2021, and involves an authenticated stored Cross-Site Scripting (XSS) vulnerability in the plugin's Facebook Pixel ID and Google Analytics ID settings (WPScan).

The vulnerability stems from insufficient sanitization of the facebook_pixel_id and google_analytics_id settings in the plugin. This security flaw allows high-privilege users to inject XSS payloads into these fields. The vulnerability has been assigned a CVSS score of 5.5 (medium) and is classified under CWE-79 (Cross-Site Scripting) (WPScan).

When exploited, the XSS payload can be executed either on pages generated by the plugin or potentially across the entire website, depending on the configured settings. The execution context depends on how the Facebook Pixel and Google Analytics tracking features are implemented within the site (WPScan).

The vulnerability requires an authenticated user with high privileges to exploit. Proof of concept exploits have been documented, demonstrating how malicious actors could inject JavaScript code through both the Facebook Pixel ID and Google Analytics ID settings (WPScan).

The vulnerability has been patched in version 1.6.13 of the Funnel Builder by CartFlows plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).