Input validation vulnerability in WPCS – WordPress Currency Switcher Professional 1.1.9

The WordPress Currency Switcher Professional plugin for WordPress is vulnerable to a type of attack called Stored Cross-Site Scripting. This issue affects users of versions up to and including 1.1.9 of the plugin. It is caused by the plugin not properly checking and blocking user input or protecting output. This means that users with at least “contributor” level permission can inject malicious web scripts into pages, which will then execute when any user views the page.