WordPress 404 to 301 plugin version 2.2.8 suffers from a persistent cross site scripting vulnerability.