Input validation vulnerability in Novelist 1.2.0

The Novelist plugin for WordPress, up to and including version 1.2.0, is vulnerable to a type of attack known as Stored Cross-Site Scripting. This type of attack can be used by someone with administrator-level access to a WordPress website to inject malicious web scripts into pages. When a user visits a page with the malicious script, it will execute and can be used to do things such as collecting personal data. This vulnerability is only present on multi-site installations of WordPress and installations where the unfiltered_html setting has been disabled.