CVE-2021-24593: 
WordPress vulnerability analysis and mitigation

The Business Hours Indicator WordPress plugin versions prior to 2.3.5 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24593. The vulnerability was discovered and publicly disclosed on August 2, 2021, affecting the plugin's 'Now closed message' setting functionality (WPScan).

The vulnerability stems from improper sanitization and escaping of the 'Now closed message' setting when it is output in both the backend and frontend of the WordPress site. This security flaw is classified as CWE-79 (Cross-Site Scripting) with a CVSS score of 3.4 (low severity). The vulnerability requires authentication to exploit, making it an authenticated stored XSS issue (WPScan, CVE Mitre).

When exploited, this vulnerability allows authenticated users to inject malicious JavaScript code through the 'Now closed message' setting. The injected code would execute when users view either the settings page in the backend or pages where the Business Hours are displayed using the plugin's shortcode (WPScan).

The vulnerability has been fixed in version 2.3.5 of the Business Hours Indicator plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).