The WP e-Commerce plugin for WordPress, up to version 1.2, has a security vulnerability that could allow a malicious user, with administrator-level access, to inject harmful scripts into pages. This would make it so that when a user accesses a page with the injected script, it will automatically execute. This vulnerability only affects multi-site installations and installations where unfiltered_html has been disabled.