labelblanc vulnerabilities and threats

The Improved Save Button plugin for WordPress up to version 1.2.1 is vulnerable to a second-order SQL Injection via the 'meta_key' custom field when using the 'Save and Duplicate' action. This vulnerability arises from insufficient escaping of user-supplied input and inadequate preparation of SQL queries, allowing authenticated users with author-level access or higher to append additional SQL commands. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level.