Input validation vulnerability in Leyka 3.30.3

The Leyka plugin for WordPress had a security vulnerability that allowed attackers with administrative-level permissions to inject malicious web scripts into pages. This was possible because the plugin did not properly sanitize and escape user input and output. The vulnerability only affected multi-site installations and installations where the “unfiltered_html” security setting had been disabled. The developer was made aware of the issue on May 30, 2023 and was able to fix it with a hot-fix in version 3.30.3.