CVE-2021-24407: 
WordPress vulnerability analysis and mitigation

The Jannah WordPress theme before version 5.4.5 contained a Reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24407. The vulnerability was discovered by Truoc Phan from Techlab Corporation and was publicly disclosed on June 14, 2021. The issue affected the theme's tie_ajax_search AJAX action functionality, where the 'query' POST parameter was not properly sanitized (WPScan).

The vulnerability has been assigned a CVSS score of 7.1 (High), indicating significant severity. The issue specifically involves improper sanitization of the 'query' POST parameter in the theme's AJAX search functionality. The vulnerability can be exploited through a POST request to '/wp-admin/admin-ajax.php' with a specifically crafted payload in the 'query' parameter (WPScan).

As a Reflected Cross-Site Scripting vulnerability, successful exploitation could allow attackers to execute malicious JavaScript code in victims' browsers within the context of the affected website. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (WPScan).

The vulnerability is remotely exploitable and requires no authentication. A proof of concept exists demonstrating the exploitation through a POST request to the affected endpoint with a malformed query parameter (WPScan).

The vulnerability has been fixed in Jannah theme version 5.4.5. Users are strongly advised to update to this version or later to mitigate the security risk (WPScan).