CVE-2016-10895: Improper Neutralization of Input During Web Page Generation

The option-tree plugin before 2.6.0 for WordPress has XSS via an addlistitem or addsociallinks AJAX request...