The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its \php_id\ setting before outputting it back in an attribute in the page leading to a stored Cross-Site Scripting issue.