CVE-2021-24653: 
WordPress vulnerability analysis and mitigation

The Cookie Bar WordPress plugin before version 1.8.9 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24653. The vulnerability was discovered on January 14, 2021, and publicly disclosed on September 22, 2021. The issue affects the Cookie Bar Message setting functionality within the plugin (WPScan, CVE Mitre).

The vulnerability stems from improper sanitization of the Cookie Bar Message setting, which could enable cross-site scripting attacks even when the unfiltered_html capability is disabled. The vulnerability has been classified as CWE-79 (Cross-site Scripting) and received a CVSS score of 3.8 (low severity). The issue specifically affects the plugin's settings page located at /wp-admin/options-general.php?page=cookie-bar-settings (WPScan).

When exploited, this vulnerability allows high-privilege users to inject and execute malicious JavaScript code that can be triggered by any user or unauthenticated visitor accessing the frontend of the website (WPScan).

The vulnerability has been patched in version 1.8.9 of the Cookie Bar plugin. Website administrators are advised to update to this version or later to mitigate the security risk (WPScan).