The Blog Settings plugin for WordPress versions up to and including 1.0 is vulnerable to reflected cross-site scripting (XSS) via the 'page' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link.