Apogeebytes

The plugin fails to validate the destination of server-side requests constructed from user-supplied input. This allows unauthenticated attackers to force the server to send requests to arbitrary hosts and retrieve responses that are parsed as RSS/XML. This behavior is known as Server-Side Request Forgery (SSRF), where an attacker induces a server-side application to make requests to an unintended location.

Stored Cross-Site Scripting (XSS) occurs because the plugin fails to sanitize and escape data from unauthenticated visitor requests before storing it and subsequently displaying it within one of its widgets. This allows unauthenticated attackers to execute malicious scripts in the browsers of users who view the affected widget.