CVE-2021-24578: 
WordPress vulnerability analysis and mitigation

The SportsPress WordPress plugin versions before 2.7.9 contained a Reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24578. The vulnerability was discovered on November 16, 2021, and affected the Events backend page of the plugin (WPScan).

The vulnerability stems from improper sanitization and escaping of the match_day parameter in the Events backend page. When this parameter is output back to the page, it can lead to a Reflected Cross-Site Scripting attack. The vulnerability has been assigned a CVSS score of 8.8 (high severity) and is classified under CWE-79 (WPScan).

If exploited, this vulnerability could allow attackers to execute malicious JavaScript code in the context of other users' browsers who access the affected admin page. This could potentially lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the authenticated user (WPScan).

The vulnerability has been fixed in SportsPress version 2.7.9. Users are advised to update to this version or later to mitigate the security risk (WPScan).