The Centangle-Team WordPress plugin up to version 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation. This allows unauthenticated attackers to modify plugin settings if they can trick an administrator into performing an action. Additionally, insufficient input sanitization and output escaping on the cai_name_color parameter enables injection of arbitrary web scripts that execute when a user accesses the affected page.