The plugin contains a Missing Authorization vulnerability due to a missing capability check in the SBF_DB_code_manage_action AJAX action, which makes it possible for authenticated attackers with a role as low as subscribers to add, edit or delete bonds. The plugin also contains a Cross-Site Scripting (XSS) vulnerability, due to the plugin does not sanitize and escape some parameters, which makes it possible to inject arbitrary web scripts.