CVE-2021-24720: 
WordPress vulnerability analysis and mitigation

The GeoDirectory Business Directory WordPress plugin versions before 2.1.1.3 contained an Authenticated Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2021-24720. The vulnerability was discovered by the Thinkland Security Team and publicly disclosed on September 2, 2021 (WPScan).

The vulnerability was classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS score of 4.8 (Medium) and is identified under CWE-79. The vulnerability could be exploited through the defaultlocationlatitude parameter in the plugin's settings page. The issue specifically affected the location settings section accessible at the path /wp-admin/admin.php?page=gd-settings&tab=general§ion=location (WPScan, Wordfence).

The vulnerability allowed authenticated users with administrative privileges to store and execute malicious JavaScript code on the affected WordPress sites. When successfully exploited, this could lead to potential client-side attacks against other administrative users accessing the affected pages (WPScan).

The vulnerability was patched in version 2.1.1.3 of the GeoDirectory plugin. Users were advised to update to this version or later to mitigate the security risk (WPScan).