Security readout for executives and security teams
Plain-English summary
This is a reflected XSS flaw in the ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2. If an administrator is logged in and the plugin is connected to Google Analytics, attacker-controlled input in ga_action could run script in the admin's browser. Business risk is mainly admin-session compromise on affected WordPress sites.
Executive priority
Treat this as a moderate-priority cleanup for WordPress properties, especially externally managed marketing sites. It is not KEV-listed and has no supplied active-exploitation evidence, but admin-context XSS can create meaningful account and site-management risk if an administrator is targeted.
Technical view
The plugin failed to sanitize or escape the ga_action parameter in the stats view before placing it into an HTML attribute. The issue maps to CWE-79. Execution occurs in the context of a logged-in administrator, and the source bundle does not provide CVSS metrics, affected CPEs, or additional vendor advisories.
Likely exposure
Exposure is limited to WordPress sites running ShareThis Dashboard for Google Analytics before 2.5.2, with the plugin connected to a Google Analytics account. Sites without the plugin, upgraded installations, or unconnected configurations are not shown as affected by the supplied sources.
Exploitation context
No source in the bundle reports active exploitation, and the CVE is not marked KEV. Successful impact depends on administrator browser context and the vulnerable stats view behavior. The bundle does not identify public exploit maturity, attacker prevalence, or confirmed compromises.
Researcher notes
Key constraints are important: vulnerable behavior is tied to ga_action in the stats view, administrator context, and Google Analytics-connected state. The supplied data lacks CVSS, CPEs, exploit observations, and detailed patch notes. Validate exposure through asset inventory and plugin configuration rather than broad WordPress assumptions.
Mitigation direction
- Update ShareThis Dashboard for Google Analytics to version 2.5.2 or later.
- Inventory WordPress sites for this plugin and record deployed versions.
- Confirm the plugin is still needed; remove it where it has no business owner.
- Restrict WordPress administrator access to trusted users and managed devices.
- Check vendor or plugin repository guidance for any additional hardening advice.
Validation and detection
- Check each WordPress installation for the plugin and version before 2.5.2.
- Confirm whether the plugin is connected to a Google Analytics account.
- Review administrator access logs for unusual activity around plugin stats pages.
- Verify update completion from WordPress plugin inventory or deployment records.
- Do not test payload execution on production without an approved change window.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-24438 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/af472879-9328-45c2-957f-e7bed77e4c2dCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.