OnePress Social Locker <= 5.6.2 - Arbitrary Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack PoC...

OnePress Social Locker <= 4.2.0 - Authenticated Reflected Cross-Site Scripting (XSS)

The OnePress Social Locker WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...