WordPress Add Custom CSS and JS plugin <= 1.20 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Add Custom CSS and JS versions = 1.20...

CVE-2024-3903: Cross-Site Request Forgery (CSRF)

The Add Custom CSS and JS WordPress plugin through 1.20 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in as author and above add Stored XSS payloads via a CSRF attack...