Safelayout Cute Preloader - CSS3 Wordpress Preloader - Reflected cross-site scripting (XSS)

 293 |
 294 | // ajax handlers
 295 | public function add_preloader_meta_box_ajax_handler() {
 296 | check_ajax_referer( 'slpl_preloader_ajax' );
 297 | $key = $_POST['key'];
 298 | if ( $key == 'show' ) {
 299 | update_option( 'safelayout_preloader_options_meta', true );
 300 | } else {
 301 | update_option( 'safelayout_preloader_options_meta', false );
 302 | }
>  303 |    echo $key;
   304 |
   305 |    wp_die();
   306 |   }
   307 |
   308 |   // ajax handlers for feedback
   309 |   public function preloader_feedback_ajax_handler() {
   310 |    check_ajax_referer( 'slpl_preloader_ajax' );
   311 |    $type = sanitize_text_field( $_POST['type'] );
   312 |    $text = sanitize_text_field( $_POST['text'] );
   313 |    $apiUrl = 'https://safelayout.com/feedback/feedback.php';
       ^ Col 0