CVE-2021-25050: 
WordPress vulnerability analysis and mitigation

CVE-2021-25050 is a stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin Remove Footer Credit versions prior to 1.0.11. The vulnerability was discovered by researcher apple502j and was publicly disclosed on January 12, 2022 (WPScan).

The vulnerability stems from improper sanitization of plugin settings, which allows high-privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. The vulnerability has been assigned a CVSS score of 3.5 (low) and is classified under CWE-79, falling into the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

When exploited, this vulnerability allows the execution of malicious scripts that would be triggered on all pages of the affected WordPress installation. The attack can be performed through the plugin's settings interface, potentially affecting all visitors to the compromised website (WPScan).

The vulnerability can be exploited by inputting malicious content in the plugin's settings, specifically in the 'Step 1: Enter text/HTML to remove' field with the value 'powered' and in the 'Step 2: Enter your own footer credit' field. The XSS payload would then be triggered across all pages (WPScan).

The vulnerability has been fixed in version 1.0.11 of the Remove Footer Credit plugin. Users are advised to update to this version or later to mitigate the risk (WPScan, WordPress Trac).