CVE-2021-24383: 
WordPress vulnerability analysis and mitigation

The WP Google Maps WordPress plugin before version 8.1.12 contained a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24383. The vulnerability was discovered in the Map Name field within the admin dashboard's Map List feature, where the plugin failed to properly sanitize, validate, or escape user input (WPScan).

The vulnerability is classified as an authenticated Stored Cross-Site Scripting (XSS) issue with a CVSS score of 4.8 (medium). The security flaw is mapped to CWE-79 and falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS). The vulnerability specifically exists in the Map Name field output in the Map List of the admin dashboard, where proper input validation and sanitization were not implemented (WPScan).

When exploited, this vulnerability allows authenticated users to inject malicious JavaScript code through the Map Name field, which gets executed when viewing the Map List in the admin dashboard. This could potentially lead to cookie theft and other client-side attacks against authenticated administrators (WPScan).

The vulnerability requires authentication to exploit. An attacker would need to have access to an account with permissions to edit maps in the WP Google Maps plugin. The exploit can be triggered by injecting malicious JavaScript code into the Map Name field, which gets stored and executed when viewing the Map List page (WPScan).

The vulnerability was fixed in version 8.1.12 of the WP Google Maps plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).