The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the \Footer Credit Text\ added to pages allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed.