WP BrowserUpdate <= 4.5 - Authenticated (Admin+) Stored Cross-Site Scripting

The WP BrowserUpdate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple parameters in versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. Combined with a Cross-Site Request Forgery vulnerability in versions <= 4.4.1, this makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute if they can successfully trick a user into performing an action such as clicking on a link. In version 4.5, this issue is only exploited by authenticated administrative users.