I think I’ve figure out the issue in the code.
assets/js/followers/wcfmu-script-followers.js
doesn’t supply a nonce in the ajax call, which probably goes as security
paramter.
If you can include that parameter in all the corresponding script, that should solve all such issues.