WordPress Magic Post Thumbnail plugin < 3.3.11 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Magic Post Thumbnail plugin versions 3.3.11. Solution Update the WordPress Magic Post Thumbnail plugin to the latest available version at least 3.3.11...

Magic Post Thumbnail < 3.3.7 - Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise or escape its ids GET parameter before outputting it back in the bulk generation page, leading to a reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=magicpostthumbnail%2Finc%2Fadmin%2Fbulkgeneration.php=...