CVE-2021-24883: 
WordPress vulnerability analysis and mitigation

The Popup Anything WordPress plugin before version 2.0.4 contains a Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24883. The vulnerability was discovered by Vishnupriya ilango and publicly disclosed on October 25, 2021. This security issue affects the Link Text and Button Text fields of the Popup functionality in the plugin (WPScan).

The vulnerability stems from improper input validation where the plugin fails to properly escape the Link Text and Button Text fields of Popup. This security weakness is classified as CWE-79 and has been assigned a CVSS score of 6.8 (medium severity). The vulnerability allows for stored Cross-Site Scripting attacks, which falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

The vulnerability can be exploited by users with privileges as low as Contributor level, potentially allowing them to inject and execute malicious scripts in the context of other users' browsers who view the affected popup content (WPScan).

The vulnerability has been patched in version 2.0.4 of the Popup Anything WordPress plugin. Site administrators are advised to update to this version or later to mitigate the security risk (WPScan).