CVE-2021-24794: 
WordPress vulnerability analysis and mitigation

The Connections Business Directory WordPress plugin versions before 10.4.3 contains a Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24794. The vulnerability was discovered by Huy Nguyen and publicly disclosed on September 28, 2021. The issue affects the plugin's Address settings functionality when creating an Entry (WPScan).

The vulnerability stems from improper input validation where the plugin fails to escape the Address settings when creating an Entry. This vulnerability is classified as CWE-79 (Cross-Site Scripting) and has been assigned a CVSS score of 3.5 (Low). The issue specifically manifests when the unfiltered_html capability is disallowed for high-privilege users (WPScan).

When exploited, this vulnerability could allow high-privilege users to execute arbitrary JavaScript code in the context of other users' browsers who access the Manage page. This could potentially lead to unauthorized actions being performed on behalf of other users viewing the affected pages (WPScan).

The vulnerability has been fixed in version 10.4.3 of the Connections Business Directory plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).