WordPress Ultimate CSV Importer plugin version 3.8.6 suffers from a cross site scripting vulnerability.