Input validation vulnerability in Favorites 2.3.3

The Favorites plugin for WordPress has a security issue called Stored Cross-Site Scripting. This happens when someone uses the ‘user_favorites’ feature in the plugin, which is available in all versions up to 2.3.3. The problem is caused by not properly checking and protecting the information that users enter, such as the ‘no_favorites’ option. This means that someone who has contributor-level access or higher can insert harmful scripts into pages, which will run when a user views that page.