Access violation vulnerability in WordPress File Upload 4.24.7

and inject malicious JavaScript code into posts or pages. The WordPress File Upload plugin for WordPress has a security issue that could allow unauthorized people to access it. This is because there is a missing check to make sure only certain users can use a function called wfu_ajax_action_save_shortcode(). This means that attackers who have certain levels of access can save shortcodes and put harmful code into posts or pages.