Input validation vulnerability in Built-in Widgets Query extend (Custom Post Types & more) 1.05

The Built-in Widgets Query extend plugin for WordPress is vulnerable to a type of attack called Reflected Cross-Site Scripting. This type of attack occurs when a malicious link or script can be added to a web page to be executed when someone clicks on it. Versions of the plugin up to and including 1.05 are vulnerable due to the insufficient input sanitization and output escaping. This means that unauthenticated attackers can inject malicious code into pages via a URL if they can trick a user into clicking on it.