Limit Bio WordPress Plugin Cross-Site Scripting Vulnerability via Cross-Site Request Forgery

A stored cross-site scripting vulnerability has been identified in the Limit Bio WordPress plugin, affecting versions through 1.0. The issue arises because the plugin lacks proper cross-site request forgery (CSRF) protection when updating settings. Additionally, it fails to adequately sanitize and escape input, potentially allowing attackers to exploit logged-in administrators by injecting malicious scripts that are stored and executed later.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.