Urgent Security Flaw

The Ad inserter plugin doesn’t escape user input so some of the code that I’m adding gets executed directly in the browser.

To replicate:-
1) Go to a new tab to add some new code
2) Add “</textarea><p>This is not secure!</p>” as the ad code
3) Save all settings
4) Reload the page

Result:- The code I’ve just added is executed directly in the page and is not editable. See example screenshot:- http://scr.hu/76g8/jmb3y

Expected Result:- Input is escaped and only executed on the front end of the site

This is a security flaw that should be addressed.

https://ww.wp.xz.cn/plugins/ad-inserter/