Cross-site scripting (XSS) flaws are one of the most commonly encountered security flaws found on websites. XSS can be exploited via XSS to steal user accounts, change settings or phish passwords from unsuspecting users. The problem was caused by following WordPresss official developers documentation: I, Joost, created the particular problem myself and was wondering how that had gotten by me, when I figured out that both the Codex and the developer documentation on WordPress.org for these functions were missing the fact that you had to escape their output. In fact, when copied their output when copied would create exploitable code straight away.”]
Source: https://grahamcluley.com/popular-wordpress-plugins-found-vulnerable-to-xss-vulnerability/