The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to an incorrect nonce check in multiple AJAX actions, which makes it possible for attackers to perform actions via a forged request if they can trick an administrator into performing an action such as clicking on a link.