CVE-2021-24432: 
WordPress vulnerability analysis and mitigation

The Advanced AJAX Product Filters WordPress plugin (versions before 1.5.4.7) contains a reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24432. The vulnerability stems from the plugin's failure to properly sanitize the 'term_id' POST parameter before outputting it in the page (WPScan).

The vulnerability is present in the br_aapf_get_child AJAX action of the plugin, which is accessible to both unauthenticated and authenticated users. The issue occurs due to improper sanitization of the 'term_id' POST parameter. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. It is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

This vulnerability allows attackers to execute reflected Cross-Site Scripting attacks against users of the affected WordPress sites. Since the vulnerability is accessible to unauthenticated users, it could potentially be exploited to perform malicious actions in the context of other users' browsers (WPScan).

The vulnerability can be exploited by sending a specially crafted POST request to the wp-admin/admin-ajax.php endpoint with a malicious payload in the 'term_id' parameter. No authentication is required to exploit this vulnerability, making it more accessible to potential attackers (WPScan).

Users should upgrade to version 1.5.4.7 or later of the Advanced AJAX Product Filters WordPress plugin to address this vulnerability (WPScan).