WP DoNotTrack <= 0.8.8 - Authenticated (admin+) Stored XSS

The plugin does not validate or escape its Blacklist and Whitelist settings, allowing high privilege users such as admin to set JavaScript payload in them, even when the unfiltered_html capability is disallowed, leading to Stored Cross-Site Scripting issues

Add the payload below in the Blacklist or Whitelist setting of the plugin (wp-admin/options-general.php?page=dnt_settings_page)

" style=animation-name:rotation onanimationstart=alert(/XSS/)//