Link Optimizer Lite <= 1.4.5 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF check when saving its settings, and is also lacking sanitisation as well as escaping in some of them, which could allow attacker to make a logged in admin change them via a CSRF attack and put Cross-Site Scripting payloads in them.