The plugin LeenkMe version 2.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS). The XSS vulnerable fields are facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, and _wp_http_referer. The vulnerable page is wp-content/plugins/leenkme/facebook.php and the vulnerable code producing XSS is if ( !empty( $_REQUEST['facebook_message'] ) ) $user_settings['facebook_message'] = $_REQUEST['facebook_message']; else $user_settings['facebook_message'] = ''; if ( !empty( $_REQUEST['facebook_linkname'] ) ) $user_settings['facebook_linkname'] = $_REQUEST['facebook_linkname']; else $user_settings['facebook_linkname'] = ''; if ( !empty( $_REQUEST['facebook_caption'] ) ) $user_settings['facebook_caption'] = $_REQUEST['facebook_caption']; else $user_settings['facebook_caption'] = ''; if ( !empty( $_REQUEST['facebook_description'] ) ) $user_settings['facebook_description'] = $_REQUEST['facebook_description']; else $user_settings['facebook_description'] = '';