CVE-2021-24443: 
WordPress vulnerability analysis and mitigation

CVE-2021-24443 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Youzify WordPress plugin versions below 1.0.7. The vulnerability was discovered by Phu Tran from techlabcorp.com and was publicly disclosed on June 28, 2021. The issue affects the Biography field in the About Me widget of the plugin (WPScan).

The vulnerability stems from improper sanitization of the Biography field in the About Me widget, which allows authenticated users to inject and execute malicious JavaScript code. The vulnerability has been assigned a CVSS score of 8.9 (High) and is classified under CWE-79. It falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

When exploited, this vulnerability could allow a low-privilege user to gain unauthorized access to the admin side of the blog by targeting an administrator. This can be achieved by inducing an admin to view a profile containing a malicious payload, potentially leading to the creation of rogue admin accounts (WPScan).

The vulnerability can be exploited by any authenticated user by inserting malicious JavaScript code into the Biography field of the About Me widget. The XSS payload is triggered when any user views the affected profile. A proof of concept demonstrates that attackers can execute arbitrary JavaScript code through the Biography field (WPScan).

The vulnerability has been fixed in Youzify version 1.0.7. Users are advised to update their Youzify plugin to this version or later to mitigate the risk (WPScan).