CVE-2021-24676

CVE-2021-24676 describes a Reflected Cross-Site Scripting (XSS) vulnerability in the Better Find and Replace WordPress plugin prior to version 1.2.9. The flaw allows an attacker to inject malicious scripts due to improper escaping of the 's' GET parameter on the All Masking Rules page. This vulnerability carries a CVSS score of 6.1 (Medium), indicating it can be exploited remotely with low attack complexity, requiring user interaction to succeed. A successful exploit could lead to limited confidentiality and integrity impacts, such as session hijacking or defacement. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in common frameworks like Metasploit or Nuclei. The vulnerability has received minimal community discussion and media coverage, suggesting low public awareness and limited attacker interest.