OneTone <= 3.0.6 - Unauthenticated Stored Cross-Site Scripting (XSS)

Due to missing capability checks and security nonces, an unauthenticated attacker can use the theme options import feature to inject JavaScript code into all pages and posts of the website...