Alexhenry

Insufficient file path validation in the ` construct()` function allows unauthenticated attackers to perform limited file deletion of theme files on the server.

Stored Cross-Site Scripting occurs via the 'customStyle' attribute of the Google Maps block. The issue stems from the use of the `eval()` function on user-controlled block content within the frontend JavaScript `mapStyles()` function. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

An authorization bypass exists due to a missing capability check in the `ai ajax` function. This flaw allows unauthenticated attackers to view the contents of ad blocks that were restricted by an administrator to be visible only to administrators.