Login with phone number < 1.3.8 - Multiple Admin+ Stored XSS

The plugin does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

PoC

Plugin settings > Style Settings > button border radius (or other field) put to input field: alert(‘XSS’);alert(‘XSS’);