CVE-2021-24564: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24564 affects the WPFront Scroll Top WordPress plugin versions before 2.0.6.07225. This security flaw was publicly disclosed on July 26, 2021, and involves a Stored Cross-Site Scripting (XSS) vulnerability that affects authenticated users with admin privileges (WPScan).

The vulnerability stems from improper sanitization and escaping of the Image ALT setting before outputting its attributes. This security weakness is classified as CWE-79 (Cross-Site Scripting) and has received a CVSS score of 4.8 (Medium severity). The vulnerability persists even when the unfiltered_html capability is disallowed (WPScan, Wordfence).

When exploited, this vulnerability allows attackers with administrative access to inject malicious JavaScript code through the Image ALT setting. The injected code can be triggered both in the plugin's setting page and on the frontend, potentially affecting site administrators and visitors (WPScan).

The vulnerability has been patched in version 2.0.6.07225 of the WPFront Scroll Top plugin. Site administrators are strongly advised to update to this version or later to mitigate the security risk (WPScan).