Administrator stored XSS via unescaped contact settings

Stored XSS in vithanhlam Zweb Social Mobile 1.0.0 and earlier allows remote authenticated users to inject scripts through four contact settings. The plugin stores the vithanhlam_zsocial_save_messager, vithanhlam_zsocial_save_zalo, vithanhlam_zsocial_save_hotline, and vithanhlam_zsocial_save_contact parameters without sufficient sanitization and later renders them without output escaping. Administrator access is required, and the payload executes when a user opens an injected page, but only on multisite installations or sites where unfiltered_html is disabled.