The plugin does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Proof of Concept
As admin, put the following payloads:
- # </textarea><svg/onload=prompt(/XSS/)> in the htaccess File Options > htaccess File Editor > secure.htaccess texture field and save
- "><svg/onload=prompt(/XSS/)> in JTC Lite > Login Form: CAPTCHA Error message / Comment Form: CAPTCHA Error message (BPS Pro Only) fields and save