The plugin does not sanitise and escape its Source Name setting, which could allow high privilege users to perform Cross-Site Scripting attacks
Put the following payload in the Source Name setting of the plugin: "><script>alert(/XSS/)</script>
2020-05-11 (about 2 years ago)
2021-10-20 (about 7 months ago)
2022-04-14 (about 1 months ago)