CVE-2021-24421: 
WordPress vulnerability analysis and mitigation

CVE-2021-24421 is a stored Cross-Site Scripting (XSS) vulnerability affecting the WP JobSearch WordPress plugin versions before 1.7.4. The vulnerability was discovered in early 2021 and publicly disclosed on June 16, 2021. The issue affects the plugin's my-resume page functionality, where multiple parameters were not properly sanitized or escaped before being output (WPScan).

The vulnerability stems from improper sanitization of multiple parameters in the my-resume page of the WP JobSearch plugin. The affected parameters include jobsearch_field_education_title[], jobsearch_field_education_academy[], jobsearch_field_experience_company[], jobsearch_field_portfolio_title[], jobsearch_field_portfolio_vurl[], jobsearch_field_portfolio_url[], jobsearch_field_skill_title[], and jobsearch_field_lang_title[]. The vulnerability has been assigned a CVSS score of 5.4 (medium) and is classified as CWE-79 (WPScan).

This vulnerability allows authenticated users with low privileges to inject JavaScript payloads into the affected parameters, resulting in a stored Cross-Site Scripting condition. When successfully exploited, the malicious JavaScript code would be executed in the context of other users viewing the affected pages (CVE Mitre).

The vulnerability requires authentication with at least a low-privilege user account to exploit. A proof of concept exists demonstrating the vulnerability through a POST request to the /plugins/jobsearch/user-dashboard/?tab=my-resume endpoint (WPScan).

The vulnerability has been fixed in WP JobSearch plugin version 1.7.4. Users are advised to update to this version or later to mitigate the risk. Additionally, the associated Careerfy theme was also affected and fixed in version 6.3.0 (WPScan).