WordPress PictoBrowser plugin version 0.3.1 suffers from cross site request forgery and cross site scripting vulnerabilities.