The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowedCreditsxiahao@webray.com.cn incReferenceshttps://wpscan.com/vulnerability/c5cbe3b4-2829-4fd2-8194-4b3a2ae0e257
