I've read through the code of the script - and the most it can do is read your cookie. This won't (probably) give away your password - but it may possibly be used for changing your password for you unless you make sure you bind to your own IP.

Spoofing with IP bound is harder - and involves spoofing your IP.