This script is possibly vulnerable to XSS (Cross-site scripting). The web application allows file upload and Acunetix was able to upload a file containing HTML content. When HTML files are allowed, XSS payload can be injected in the file uploaded. Check Attack details for more information about this attack.
Restrict file types accepted for upload: check the file extension and only allow certain files to be uploaded. Use a whitelist approach instead of a blacklist. Check for double extensions such as .php.png. Check for files without a filename like .htaccess (on ASP.NET, check for configuration files like web.config). Change the permissions on the upload folder so the files within it are not executable. If possible, rename the files that are uploaded.
OWASP Unrestricted File Upload
Why File Upload Forms are a major security threat
WordPress Plugin Polldaddy Polls & Ratings Cross-Site Scripting (2.0.24)
WordPress Plugin WP Live Chat Support Pro Arbitrary File Upload (8.0.06)
WordPress Plugin Csv2WPeC Coupon Arbitrary File Upload (1.1)
WordPress Plugin WP Statistics Cross-Site Scripting (8.3)
WordPress Plugin InBoundio Marketing Arbitrary File Upload (2.0.3)