The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved allowing for Cross-Site Scripting issues. Furthermore it is also lacking any CSRF check allowing attacker to make a logged in high privilege user save arbitrary setting via a CSRF attack.