Input validation vulnerability in Dashboard To-Do List 1.3.1

A popular plugin called “Dashboard To-Do List” for WordPress has a security issue. It is possible for hackers to make unauthorized changes to your website if you have version 1.3.1 or below. This happens because the plugin does not properly check for a security code called “nonce” when updating widgets. This means that someone who is not logged in and does not have permission could trick the website administrator into clicking on a link, allowing them to make changes.