CVE-2021-24420: 
WordPress vulnerability analysis and mitigation

The Request a Quote WordPress plugin versions before 2.3.4 contained a Stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on June 16, 2021, and was assigned CVE-2021-24420. The issue affected the plugin's quote management functionality where certain fields were not properly sanitized and escaped (WPScan).

The vulnerability was caused by improper sanitization and escaping of quote fields when adding or editing quotes as an administrator. The affected fields included 'First Name', 'Last Name', 'Address', 'City', and 'Additional Details'. When these fields were displayed in the 'All Quotes' table, the unsanitized input could trigger XSS. The vulnerability received a CVSS score of 4.8 (medium) and was classified under CWE-79 (WPScan).

While the vulnerability required administrator access, it could bypass the UNFILTERED_HTML capability restriction. When exploited, the vulnerability allowed for stored XSS attacks, potentially affecting other administrators viewing the 'All Quotes' table (WPScan).

The vulnerability was fixed in version 2.3.4 of the Request a Quote plugin. Users should update to this version or later to protect against this security issue (WPScan).