WordPress DrawBlog plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The DrawBlog plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in DrawBlog WordPress plugin version 0.90 and earlier, which stems from the plugin’s failure to clean or validate certain settings before exporting them back to the page . An attacker could exploit this vulnerability to cause a stored cross-site scripting issue.