CVE-2021-24569: 
WordPress vulnerability analysis and mitigation

CVE-2021-24569 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Cookie Notice & Compliance for GDPR / CCPA WordPress plugin versions before 2.1.2. The vulnerability was discovered by Asif Nawaz Minhas and publicly disclosed on August 30, 2021 (WPScan).

The vulnerability stems from improper input validation where the plugin fails to escape the value of its Button Text setting when outputting it in an attribute in the frontend. This security flaw exists even when the unfiltered_html capability is disallowed. The vulnerability has been assigned a CVSS score of 3.4 (low) and is classified under CWE-79 (WPScan).

This vulnerability allows high-privilege users such as administrators to perform Cross-Site Scripting attacks on the website. The successful exploitation could lead to the execution of malicious JavaScript code in users' browsers when they visit the affected pages (WPScan).

The vulnerability has been fixed in version 2.1.2 of the Cookie Notice & Compliance for GDPR / CCPA plugin. Website administrators should update to this version or later to mitigate the security risk (WPScan).