The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check when creating employees and services, and it's also contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for attackers to inject arbitrary web scripts into pages via a forged request if they can trick an administrator into performing an action such as clicking on a link.