Insufficient input sanitization and output escaping in the `gdrts live handler` AJAX function allow unauthenticated attackers to perform Stored Cross-Site Scripting. By manipulating the `title` and `url` render arguments, an attacker can inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. Although the AJAX action requires a per-item nonce (a unique token used to prevent replay attacks), this token is publicly exposed in the JSON block of the page, allowing any visitor to obtain it.