BSK PDF Manager < 2.9.1 - Authenticated Stored Cross-Site Scripting (XSS)

Description

The plugin did not sanitise the view and cat_title POST parameter when creating or editing a category (/wp-admin/admin.php?page=bsk-pdf-manager), allowing authenticated users with a role as low as editor to set an XSS payload which will be triggered in the Categories list (wp-admin/admin.php?page=bsk-pdf-manager), Bulk Add by Media Library /wp-admin/admin.php?page=bsk-pdf-manager-add-by-media-library) and BSK PDF Documents (when the affected Category is used, wp-admin/admin.php?page=bsk-pdf-manager-pdfs).

The issue was initially from 2014 in v1.3, but was still present up to version 2.9, via the Category Title (cat_title POST parameter).