CVE-2024-13221: 
WordPress vulnerability analysis and mitigation

The Fantastic ElasticSearch WordPress plugin through version 4.1.0 contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-13221). The vulnerability was discovered and publicly disclosed on January 10, 2025. The issue affects the plugin's parameter handling functionality, where user input is not properly sanitized before being reflected back to the page (WPScan).

The vulnerability stems from improper sanitization and escaping of a parameter in the plugin's admin interface. Specifically, the vulnerability can be exploited through the 'tab' parameter in the admin page URL. The CVSS 3.1 vector string initially assigned was AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, though this was later removed during reassessment (NVD).

The vulnerability could be exploited against high-privilege users such as administrators. A successful exploitation could allow an attacker to execute arbitrary JavaScript code in the context of the targeted user's browser session (WPScan).

A proof of concept exploit exists that demonstrates the vulnerability can be triggered via a specially crafted URL: https://example.com/wp-admin/admin.php?page=elastic_search&tab=index">alert(1)&action=testxss">alert(1) (WPScan).

Currently, there is no known fix available for this vulnerability in the Fantastic ElasticSearch WordPress plugin (WPScan).