Input validation vulnerability in Power BI Embedded for WordPress 1.1.3

The Power BI Embedded for WordPress plugin is vulnerable to an attack called Stored Cross-Site Scripting. This attack can be done by editing the ‘_power_bi_width’ and ‘_power_bi_height’ parameters on the ‘Edit Power BI’ page. This type of attack can be done by anyone with contributor level permissions or higher on versions of the plugin up to and including 1.1.3. It allows attackers to inject malicious web scripts into pages which will be executed every time someone visits the page.