Alojapro Widget < 1.1.16 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Put the following code in the Custom CSS settings of the plugin

</style>
<script>
setTimeout("alert('1')",3000)
</script>
<style>