The settings page of the Redirect 404 to parent WordPress plugin before 1.3.1 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.12662·Published 2021-05-14·Fixed in 1.3.1CWE-79