CVE-2021-24789

The CVE refers to WordPress Flat Preloader plugin pre-1.5.5. Connected sources confirm a cross-site scripting (XSS) vulnerability where certain settings are not escaped when output in HTML attributes, enabling an attacker with admin-level access to trigger client-side JS even when unfiltered_html...