Ma Long

**Name of the Vulnerable Software and Affected Versions** WolfNet IDX for WordPress plugin versions 1.19.1 and earlier **Description** The issue allows high privilege users, such as admin, to perform Stored Cross-Site Scripting attacks even when the unfiltered html capability is disallowed, for example in a multisite setup. This is due to the plugin not sanitizing and escaping some of its settings. **Recommendations** For versions 1.19.1 and earlier, consider disabling the plugin until a patch is available to prevent Stored Cross-Site Scripting attacks. Restrict access to the plugin's settings to minimize the risk of exploitation. Avoid using the plugin in multisite setups where the unfiltered html capability is disallowed until the issue is resolved.