CVE-2021-24961: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24961 affects the WordPress File Upload plugin (both regular and pro versions) before version 4.16.3. The vulnerability was discovered by researcher apple502j and was publicly disclosed on February 14, 2022. This security issue exists in the plugin's shortcode functionality where certain arguments are not properly escaped (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, with a CVSS score of 6.8 (medium severity). It is categorized under OWASP Top 10 as A7: Cross-Site Scripting (XSS) and has a CWE classification of CWE-79. The technical issue stems from insufficient escaping of shortcode arguments in the plugin's implementation (WPScan).

The vulnerability allows users with privileges as low as Contributor level to perform Cross-Site Scripting attacks. This means that malicious actors with minimal access rights to the WordPress installation can potentially inject and execute malicious scripts (CVE Mitre).

The vulnerability has been fixed in version 4.16.3 of both the regular WordPress File Upload plugin and the Pro version. Users are advised to update their installations to this version or later to mitigate the security risk (WPScan).