WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields

Description

The plugin does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a plugin-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.