Wpscanteam

The issue is due to missing capability and nonce checks in the `pa dismiss admin notice` AJAX action, making it possible for authenticated subscriber+ attackers to change arbitrary options with a restricted value of 1 on vulnerable WordPress sites. This is a high-severity vulnerability that impacts multiple versions of the plugin. Users are urged to update to the latest version immediately to mitigate risks.

The issue allows an attacker to trick logged-in users into performing various actions on their behalf on the site due to the lack of CSRF checks for AJAX actions.

The issue concerns the improper escaping of URLs concatenated to onclick event handlers, making Stored Cross-Site Scripting attacks possible.