CVE-2021-24408: 
WordPress vulnerability analysis and mitigation

The Prismatic WordPress plugin before version 2.8 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24408. The vulnerability was discovered and disclosed on June 21, 2021, affecting users with roles as low as Contributor. The issue exists in the plugin's shortcode parameters that are not properly sanitized or validated (WPScan).

The vulnerability stems from improper sanitization of shortcode parameters, specifically in three injection points: the prismatic_code shortcode's 'class' attribute, prismatic_encoded shortcode-like syntax with HTML attributes nested inside prismatic_code shortcode, and Base-64ed payload inside prismatic_encoded shortcode-like syntax nested inside prismatic_code shortcode. The vulnerability has been assigned a CVSS score of 6.8 (medium) and is classified as CWE-79: Cross-Site Scripting (WPScan).

The vulnerability allows attackers to inject malicious scripts that can execute in victims' browsers. While posts from contributors require admin approval for the XSS to be triggered in the frontend, higher privileged users like editors can exploit this vulnerability without approval, even when the blog disallows the unfiltered_html capability (WPScan).

The vulnerability can be exploited through multiple vectors, including the use of HTML attributes and event handlers. Proof of concept code demonstrates exploitation using animation events and onclick handlers. The XSS payload can be triggered either automatically (using the Twenty Twenty-One theme) or through user interaction depending on the implementation (WPScan).

The vulnerability has been fixed in Prismatic version 2.8. Users are advised to upgrade to this version or later to mitigate the risk (WPScan).