Input validation vulnerability in WP Social AutoConnect 4.0.5

The WP-FB-AutoConnect plugin for WordPress is vulnerable to a security issue called Stored Cross-Site Scripting. This security issue affects versions up to and including 4.0.5 of the plugin, and can be used by unauthenticated attackers to inject malicious web scripts into pages. When a user accesses one of these injected pages, the malicious script will execute. This security issue occurs because the plugin does not properly sanitize and escape the ‘jfb_email_to’, ‘jfb_stream_content’, ‘jfb_api_key’, and ‘jfb_api_sec’ variables.