Input validation vulnerability in Event Registration Calendar By vcita 1.3.1

The Event Registration Calendar by vcita plugin and the Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress have a security issue. It is possible for someone who is not authorized to access the plugin’s settings and inject malicious JavaScript, with the help of an administrator. This can be done if the administrator can be tricked into performing certain actions like clicking a link. To prevent this, the plugins should be updated to include a nonce validation in the ls_parse_vcita_callback() function.