CVE-2021-24332: 
WordPress vulnerability analysis and mitigation

The Autoptimize WordPress plugin versions before 2.8.4 contained a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24332. The vulnerability was discovered and publicly disclosed on May 7, 2021. The issue affected the plugin's settings functionality, specifically impacting WordPress installations using the vulnerable versions of Autoptimize (WPScan).

The vulnerability stemmed from improper escaping and sanitization in the plugin's settings, particularly in the API Key settings and CSS configuration areas. The issue was classified as CWE-79 (Cross-Site Scripting) with a CVSS score of 6.6 (medium severity). The vulnerability allowed high-privilege users to inject XSS payloads into specific plugin settings, creating stored Cross-Site Scripting issues that would persist in the application (WPScan).

The vulnerability could allow authenticated users with high privileges to store malicious JavaScript code in the plugin settings. When other users accessed the affected admin pages, the stored XSS payload would execute in their browsers, potentially leading to unauthorized actions, data theft, or further compromise of the WordPress installation (WPScan).

The vulnerability required an authenticated user with high privileges to exploit. Proof of concept exploits demonstrated that the vulnerability could be triggered through the plugin's settings page at '/wp-admin/options-general.php?page=ao_critcss' by injecting malicious payloads into the API Key settings and CSS configuration options (WPScan).

The vulnerability was patched in Autoptimize version 2.8.4. Website administrators running affected versions should upgrade to version 2.8.4 or later to mitigate this security issue (WPScan).