Stored XSS via unauthorized plugin settings write

Stored XSS in WP Total Hacks 4.7.2 and earlier allows remote authenticated users to execute script in an administrator's browser. The plugin accepts a subscriber's POST to /wp-admin/ and writes attacker-controlled settings such as wfb_admin_footer_text without authorization, sanitization, or output escaping. Subscriber access is required, and the script runs when an administrator views content that renders the poisoned setting, allowing actions or data access in that administrator's browser context.