The plugin did not sanitise or escape the page parameter before outputting back in an attribute, leading to a reflected Cross-Site Scripting issue
plugins.trac.wordpress.org/changeset/2543438