Administrator-level stored XSS via unescaped Exceptions setting

Stored XSS in the Exceptions setting of fpoller Private WP suite 0.4.1 and earlier allows remote authenticated users to inject scripts. The setting stores administrator-supplied content without sufficient input sanitization and later renders it without output escaping, causing scripts to execute when an affected page is accessed. Administrator access is required, and exposure is limited to WordPress multisite installations or installations with unfiltered_html disabled; script execution can read or alter data available to the victim's browser.