CVE-2021-24418: 
WordPress vulnerability analysis and mitigation

The Smooth Scroll Page Up/Down Buttons WordPress plugin before version 1.4.1 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability exists due to improper sanitization and validation of the psb_positioning settings parameter (WPScan).

The vulnerability allows high-privilege users such as administrators to inject malicious XSS payloads into the psb_positioning settings. These payloads are then executed on all pages of the blog when viewed by any user. The issue stems from insufficient input validation and sanitization of the positioning parameter (Wordfence).

When successfully exploited, the vulnerability allows attackers to execute arbitrary JavaScript code in users' browsers who visit the affected pages. This could lead to cookie theft, session hijacking, or other client-side attacks (WPScan).

The vulnerability requires an authenticated user with high privileges (such as administrator access) to exploit. A proof of concept exists demonstrating how an attacker can inject malicious JavaScript code that executes when users move their mouse over affected elements (WPScan).

Users should update to version 1.4.1 or later of the Smooth Scroll Page Up/Down Buttons plugin which contains a fix for this vulnerability (WPScan).