CVE-2021-24671: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24671 affects the MX Time Zone Clocks WordPress plugin versions before 3.4.1. The vulnerability was discovered and publicly disclosed on August 25, 2021. It is a Cross-Site Scripting (XSS) vulnerability that affects WordPress installations using the vulnerable plugin versions (WPScan).

The vulnerability stems from improper input validation where the plugin does not properly escape the timezone attribute of the mxmtzctimezoneclocks shortcode. This security flaw has been assigned a CVSS v3.1 score of 5.4 (Medium) and is classified as CWE-79. The vulnerability falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

The vulnerability allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. This means that malicious actors with contributor-level access can inject and store malicious scripts that will be executed when other users view the affected content (WPScan).

The vulnerability has been fixed in version 3.4.1 of the MX Time Zone Clocks plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).