Input validation vulnerability in ApplyOnline – Application Form Builder and Manager 2.5

The ApplyOnline – Application Form Builder and Manager plugin for WordPress is vulnerable to a type of attack called Stored Cross-Site Scripting in versions up to 2.5. This attack can be used by people with administrator-level access to inject malicious web scripts into pages. When a user visits these pages, the malicious code will execute. This attack only affects WordPress multi-site installations and installations where a certain security feature called ‘unfiltered_html’ has been disabled.