CVE-2021-24898: 
WordPress vulnerability analysis and mitigation

The EditableTable WordPress plugin through version 0.1.4 contains a Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24898. The vulnerability was discovered by Vaibhav Koli and was publicly disclosed on October 25, 2021. This security issue affects the Table and Column fields within the plugin, potentially exposing WordPress installations to XSS attacks (WPScan).

The vulnerability stems from improper sanitization and escaping of the Table and Column fields in the EditableTable plugin. It is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS 3.1 Base Score of 4.8 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability can be exploited even when the unfiltered_html capability is disallowed (NVD).

When exploited, this vulnerability allows high-privilege users to perform Cross-Site Scripting attacks. The impact is considered medium severity, with potential for limited confidentiality and integrity breaches (NVD).

The vulnerability can be exploited by creating a new EDTB and inserting malicious payloads in the Table Name, Column Name, or Column Label fields. The attack requires high privileges and user interaction to be successful (WPScan).

As of the latest reports, there is no known fix available for this vulnerability in the EditableTable WordPress plugin (WPScan).