CVE-2022-4265: The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiatin

The Replyable WordPress plugin before version 2.2.10 has a security flaw where it doesn't check the class names that users submit when creating objects in a specific action, and it also lacks CSRF protection (cross-site request forgery, where an attacker tricks a user into performing actions without their knowledge). This allows authenticated users, even those with basic subscriber permissions, to perform object injection attacks (exploiting how the plugin creates objects to run unintended code).