Input validation vulnerability in Instant CSS 1.2.1

The Instant CSS plugin for WordPress has an issue with security in versions up to, and including, 1.2.1. This means that attackers who are not logged in or authenticated can take advantage of a flaw in the plugin, and potentially access theme, css, minify, and preprocessor data, just by getting a site administrator to click on a link. This is because the plugin is missing or not properly using a security code called a nonce, which is used in the class.instantcss_ajax.php file for functions called through AJAX.