CVE-2021-24409

CVE-2021-24409 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the Prismatic WordPress plugin versions prior to 2.8. This flaw allows an attacker to inject malicious scripts into a web page by manipulating the 'tab' GET parameter, which is then executed in the context of a logged-in administrator. Rated as Medium severity with a CVSS score of 6.1, the attack requires user interaction (UI:R) but can be executed remotely (AV:N) with low complexity (AC:L), potentially leading to limited confidentiality and integrity impacts (C:L/I:L). While there is no evidence of active exploitation or Metasploit modules, Nuclei templates exist for detection, and the vulnerability has garnered minimal community discussion or media coverage.