denis-de-bernardy vulnerabilities and threats

The Author Image plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'display_name' parameter. This affects all versions up to and including 4.9.3. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.