CVE-2021-24958: 
WordPress vulnerability analysis and mitigation

CVE-2021-24958 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Meks Easy Photo Feed Widget WordPress plugin versions below 1.2.4. The vulnerability was discovered by Krzysztof Zając and publicly disclosed on November 10, 2021 (WPScan).

The vulnerability stems from the plugin's lack of capability and CSRF checks in the mekssavebusinessselectedaccount AJAX action. This action is accessible to any authenticated user, and certain settings are not properly escaped. The vulnerability has been assigned a CVSS score of 5.4 (medium severity) and is classified under CWE-79 (Cross-site Scripting) (WPScan).

When exploited, this vulnerability allows any authenticated user, including those with subscriber-level access, to update the plugin's settings and inject malicious Cross-Site Scripting payloads. These payloads are then triggered when an administrator accesses the plugin's settings page (WPScan).

The vulnerability has been fixed in version 1.2.4 of the Meks Easy Photo Feed Widget plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).