Input validation vulnerability in Favorites 2.3.2

The Favorites plugin for WordPress is vulnerable to a type of malicious attack called Stored Cross-Site Scripting. If you are using versions of the plugin up to and including 2.3.2, any user with a contributor-level or higher permission can use the ‘user_favorites’ shortcode to inject arbitrary web scripts into pages. These scripts will then execute whenever a user visits the injected page.