Input validation vulnerability in Order auto complete for WooCommerce 1.2.0

The Order Auto Complete for WooCommerce plugin for WordPress is vulnerable to a type of attack called Stored Cross-Site Scripting in versions up to, and including, 1.2.0. This attack can be used by someone with administrator-level access and above to inject malicious web scripts into pages. Once a page is injected, the malicious script will execute each time a user accesses the page. This type of attack only affects multi-site installations and installations where the unfiltered_html has been disabled.