The Ortto plugin for WordPress versions before 1.0.25 contains a stored cross-site scripting (XSS) vulnerability due to improper escaping of stored settings on its admin settings page. This flaw allows a threat actor with the ability to modify the plugin's configuration to execute arbitrary JavaScript in an administrator's session when the affected page is visited.