CVE-2016-1000133

The Forget About Shortcode Buttons plugin for WordPress before version 1.1.2 contains a reflected cross-site scripting vulnerability in the 'ajax_url' variable. An attacker could exploit this flaw by crafting a malicious link that, when clicked by a user, would execute arbitrary JavaScript code in the victim's browser due to improper input sanitization and output escaping. Since the plugin fails to properly validate and encode user-supplied data, unauthenticated attackers can inject malicious scripts that execute in the context of the affected page.

Based on public CVE data (MITRE/NVD).