Fix XSS/CSRF vulnerability

This is an emergency release to fix an XSS/CSRF vulnerability discovered by Tom Adams and reported by a WordPress Plugin Repository moderator.