All 404 Redirect to Homepage < 2.1 - Authenticated Stored Cross-Site Scripting (XSS)

Description

The plugin (v1.21) attempted to fix a Stored Cross-Site scripting issue in its "Redirect All 404 page to" settings, however the fix is insufficient, still allowing the issue to be triggered. This could allow high privilege users (even with the unfiltered_html disabled) to use malicious payloads in it, leading to a Stored XSS issue.

The vendor was notified on April 27th, 2021 about it via the WP plugins team. v2.1 fixing the issue was released on August 16th, 2021