Buy Me a Coffee < 3.7 - Admin+ Stored XSS

Multiple admin settings are vulnerable to XSS:

First:

- Enable Widget and select Customize widget
- At the description or Widget message parameters add: `"autofocus onfocus=alert(1)//`
- Save and navigate back to "Customize Widget" and XSS will be shown.

Second:

- In the plugin settings, select "Customize Button". 
- Intercept the request and add the payload `<img src=x onerror=alert(document.cookie)>` to the `text` parameter. 
- The XSS will then be saved in the database, bypassing the `maxlength` check on the field.