Input validation vulnerability in Buy Me a Coffee – Button and Widget Plugin 3.6

The “Buy Me a Coffee – Button and Widget Plugin” plugin for WordPress is vulnerable to a type of attack called Cross-Site Scripting. This means that in versions up to 3.6, someone with permission to edit a page (such as a subscriber or higher) could add malicious code without the knowledge of the user. This malicious code would then be executed when a page is accessed by someone else, potentially allowing the attacker to gain access to personal information.