CVE-2021-24850: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24850 affects the Insert Pages WordPress plugin versions below 3.7.0. This stored Cross-Site Scripting (XSS) vulnerability was discovered and reported by Francesco Carlucci, and was publicly disclosed on October 18, 2021 (WPScan).

The Insert Pages plugin adds a shortcode functionality that prints out other pages' content and custom fields. The vulnerability allows users with Contributor-level permissions or higher to perform Cross-Site Scripting attacks by storing malicious payloads in another post's custom fields. The vulnerability has been assigned a CVSS score of 6.8 (medium) and is classified under CWE-79 (WPScan).

When exploited, this vulnerability allows attackers with Contributor-level access to store and execute malicious JavaScript code through custom fields, potentially affecting other users who view the compromised pages (WPScan).

The vulnerability can be exploited by creating a page with a custom field containing JavaScript code, then creating another page with a shortcode referencing the first page using the format: [insert page="page_A_slug" display="all"] (WPScan).

The vulnerability has been fixed in version 3.7.0 of the Insert Pages plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).