Input validation vulnerability in InLocation 1.8

The InLocation plugin for WordPress has a security issue called Cross-Site Request Forgery. This can happen in all versions of the plugin, including 1.8. The problem is that the plugin does not properly check for a special code called a “nonce” when performing certain functions. This allows hackers to make changes to the plugin settings and add harmful code to the website if they can trick the website administrator into clicking on a link.