Input validation vulnerability in Smarty for WordPress 3.1.35

The Smarty for WordPress plugin is vulnerable to a type of attack known as Stored Cross-Site Scripting. This type of attack is possible if you have an outdated version of the plugin, up to and including version 3.1.35. The vulnerability is caused by the plugin not properly sanitizing or escaping data input or output. This means that if an attacker with administrator-level access or above injects malicious code, it will be executed when someone views the page. This only applies to multi-site WordPress installations or installations where the unfiltered_html setting has been disabled.