Input validation vulnerability in WP Edit Username 1.0.5

The WP Edit Username plugin for WordPress is vulnerable to a type of cyber attack called Stored Cross-Site Scripting. This attack is possible on all versions of the plugin up to and including version 1.0.5. The attack can be done by someone who has administrator-level access to the plugin. The attack would allow them to insert malicious code into a page which will be executed anytime someone else accesses the page. This attack is only possible on multi-site installations and installations where a security feature called unfiltered_html has been disabled.