Input validation vulnerability in metro 2.13

The design for WordPress called Metro has a security issue called Reflected Cross-Site Scripting. This problem can be found in versions up to and including 2.13. The reason for this is that the design does not properly clean up user input and output. This means that attackers who are not logged in can add harmful code to websites. They can do this if they can trick someone into clicking on a link.