Input validation vulnerability in Marker.io – Visual Website Feedback 1.1.8

The Marker.io plugin for WordPress has a security issue called Cross-Site Request Forgery. This can affect versions up to 1.1.8. The problem is that the plugin does not properly check for a special code (called a nonce) when saving options. This means that someone who is not logged in can make changes to the plugin’s settings if they are able to trick a site administrator into clicking a link.