CVE-2021-24480: 
WordPress vulnerability analysis and mitigation

The Event Geek WordPress plugin through version 2.5.2 contains a stored Cross-Site Scripting (XSS) vulnerability. The issue was discovered and disclosed on June 28, 2021, affecting the plugin's "Use your own theme" setting functionality (WPScan).

The vulnerability exists because the plugin fails to properly sanitize or escape the "Use your own theme" setting before outputting it on the page. This vulnerability has been assigned a CVSS score of 5.5 (Medium) and is classified under CWE-79: Cross-Site Scripting. The vulnerability requires authentication with administrative privileges to exploit (WPScan).

If successfully exploited, an authenticated attacker with administrative access could inject malicious JavaScript code that would execute in users' browsers when they view the affected pages. This could potentially lead to cookie theft, session hijacking, or other client-side attacks (WPScan).

At the time of disclosure, there was no known fix available for this vulnerability. Users of the Event Geek plugin should consider implementing additional security controls or replacing the plugin with a secure alternative (WPScan).