WordPress Click To Top plugin version 1.2.7 suffers from a persistent cross site scripting vulnerability.