Input validation vulnerability in All in One Invite Codes 1.0.15

The All in One Invite Codes plugin for WordPress is vulnerable to a type of security issue called Stored Cross-Site Scripting. This vulnerability exists in versions of the plugin up to and including version 1.0.15. It happens when the ‘$message_text’ parameter is not properly sanitized and escaped, which allows attackers with administrative privileges to insert malicious web scripts into the website. Whenever someone visits a page with the malicious scripts, the scripts will execute.