CVE-2021-24381: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24381 affects the Ninja Forms Contact Form WordPress plugin versions before 3.5.8.2. The vulnerability was discovered by Rodel Plasabas and was publicly disclosed on September 27, 2021. This security issue involves improper sanitization and escaping of custom class names in form fields (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS score of 3.5 (low severity). It is categorized under CWE-79 and falls into the OWASP Top 10 category A7: Cross-Site Scripting (XSS). The technical issue stems from the plugin's failure to properly sanitize and escape custom class names in form fields created within the system (WPScan).

This vulnerability could allow high-privilege users to perform Cross-Site Scripting attacks, even in cases where the unfiltered_html capability is explicitly disallowed. The impact is particularly concerning for WordPress installations where multiple administrators or high-privilege users have access to the form builder (WPScan).

The vulnerability has been patched in version 3.5.8.2 of the Ninja Forms plugin. Users are advised to update their installations to this version or later to mitigate the security risk (WPScan).