CVE-2021-24611: 
WordPress vulnerability analysis and mitigation

The Keyword Meta WordPress plugin through version 3.0 contains multiple security vulnerabilities discovered and disclosed on August 9, 2021. The plugin lacks proper input sanitization and CSRF protection in its settings functionality, affecting WordPress installations using this plugin (WPScan Advisory).

The vulnerability combines two security issues: a Cross-Site Scripting (XSS) vulnerability due to unsanitized settings output, and a Cross-Site Request Forgery (CSRF) vulnerability allowing attackers to manipulate plugin settings. The CVSS v3.1 base score is 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is tracked under CWE-79 (Cross-site Scripting) and CWE-352 (Cross-Site Request Forgery) (NVD).

An attacker could exploit these vulnerabilities to execute arbitrary JavaScript code in users' browsers and make unauthorized changes to plugin settings through CSRF attacks when a high-privilege user is logged in (WPScan Advisory).

There is no known fix for this vulnerability as the plugin has been permanently closed. Users are advised to remove the plugin from their WordPress installations and seek alternative solutions (WPScan Advisory).