WordPress Magic Fields 1 plugin version 1.7.1 suffers from a persistent cross site scripting vulnerability.