Input validation vulnerability in Smart PopUp Blaster 1.4.3

The Smart PopUp Blaster plugin for WordPress has a security issue that makes it vulnerable to an attack called Stored Cross-Site Scripting. This can happen when someone uses a certain part of the plugin called the ‘spb-button’ shortcode. The problem is that the plugin doesn’t properly check the information it receives from users or make it safe before showing it on a webpage. This means that someone with the right level of access can add harmful code to a page that will run when someone visits it.