CVE-2021-24541: 
WordPress vulnerability analysis and mitigation

The Wonder PDF Embed WordPress plugin, versions below 1.7, contained a stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2021-24541. The vulnerability was discovered by researcher apple502j and publicly disclosed on July 19, 2021. The security issue affected the plugin's wonderplugin_pdf shortcode functionality (WPScan).

The vulnerability stems from insufficient parameter escaping in the wonderpluginpdf shortcode implementation. The CVSS score for this vulnerability is 6.4, indicating a medium severity level. A proof of concept exploit involves using the following code: `[wonderpluginpdf src="a" onload="alert(1)"]`. The vulnerability is classified under CWE-79, which relates to improper neutralization of input during web page generation (WPScan).

The vulnerability allows users with privileges as low as Contributor level to perform Stored Cross-Site Scripting attacks. This could potentially enable malicious actors to inject and execute arbitrary JavaScript code in the context of other users' browsers who view the affected pages (WPScan).

The vulnerability has been patched in version 1.7 of the Wonder PDF Embed plugin. Site administrators are advised to update to this version or later to mitigate the security risk (WPScan).