CVE-2021-24505: 
WordPress vulnerability analysis and mitigation

CVE-2021-24505 is an Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in the WordPress Forms plugin (forms-by-made-it) versions below 1.12.3. The vulnerability was publicly disclosed on July 3, 2021, and was identified by security researcher SHUBHANGI DAWKHAR (WPScan).

The vulnerability exists due to insufficient input sanitization in the Forms plugin's 'Add New' field. Specifically, the plugin failed to properly sanitize input fields, allowing for stored XSS attacks. The vulnerability has been assigned a CVSS score of 3.5 (low severity) and is classified under CWE-79, falling into the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

When exploited, this vulnerability allows authenticated users to store and execute malicious JavaScript code that will be triggered whenever users access the affected plugin sections. This could potentially lead to unauthorized actions being performed on behalf of other users who view the compromised pages (WPScan).

The vulnerability has been fixed in version 1.12.3 of the Forms plugin. Users are advised to update to this version or later to mitigate the risk. The fix can be found in the WordPress plugin repository (WordPress Plugin).