Wordfence’s advisory stated that the plugin featured a Stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to upload a malicious script and attack website visitor browsers, which can lead to stealing session cookies in order to gain control of the website.

XSS vulnerabilities are among the most common, resulting from a failure to properly sanitize (screen or filter) fields that take user inputs such as text or images.

Plugins often “sanitize” inputs, which implies they remove unnecessary inputs such as scripts.

Another weakness that leads to an XSS vulnerability is a failure to “escape output,” which implies removing any output that contains undesired data in order to prevent it from reaching the browser.

Wordfence identifies both of these problems as contributing to the vulnerabilities.