Input validation vulnerability in Category Post List Widget 2.0

The Category Post List Widget plugin for WordPress is vulnerable to malicious code being inserted into its pages. This malicious code can be inserted by unauthenticated attackers and will execute whenever a user visits a page with the malicious code. This vulnerability exists in versions up to and including version 2.0 of the plugin and is caused by the lack of input sanitization, output escaping and a nonce check on the ‘get_cplw_settings’ function.