CVE-2021-36911: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in WordPress Comment Engine Pro plugin versions 1.0 and below. The vulnerability, identified as CVE-2021-36911, was reported on July 19, 2021, and could be exploited by users with Editor or higher role privileges (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) by NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Patchstack assessed it with a slightly lower CVSS score of 4.8 (Low). The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD, Patchstack).

This vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

No official fix is available for this vulnerability. The plugin has been removed from the WordPress plugin repository due to the security issue. Users are advised to remove and replace the plugin with a secure alternative (Patchstack).