WordPress Z-URL Preview plugin version 1.6.1 suffers from a persistent cross site scripting vulnerability.