Wordpress online shop plug-in eShop Multiple xss

Product: eShop for Wordpress
Vendor: Rich Pedley (http://wordpress.org/extend/plugins/eshop)
Vulnerable Version: 6.2.8 and probably prior
Tested on: 6.2.8
Vendornotification: 20 July 2011
Vulnerability Type: XSS (Cross Site Scripting)
Status: Fixed by Vendor
Risk level: Medium
Credit: High-Tech Bridge SA Security Research Lab (http://www.htbridge.ch/advisory \
)

Vulnerability Details:
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in \
EShop for Wordpress, which can be exploited to perform cross-site scripting attacks \
Against logged-in Wordpress Administrator.

1) Input passed via the "eshoptemplate" GET parameter to/wp-admin/admin. php (when \
"Page" is set to "eshop-templates.php") is not properly sanitised before being \
Returned to the user. This can be exploited to execute arbitrary HTML and script code \
In a administrator's browser session in context of affected website.

The following PoC code is available:

Http: // [www.2cto.com]/wp-admin/admin. php? Page = eshop-templates.php & eshoptemplate = % 22% 3E % 3 Cscrip \
T % 3 Ealert % 28document. cookie % 29; % 3C/script % 3E

2) Input passed via the "action" GET parameter to/wp-admin/admin. php (when "page" is \
Set to "eshop-orders.php") is not properly sanitised before being returned to \
User. This can be exploited to execute arbitrary HTML and script code in \
Administrator's browser session in context of affected website.

The following PoC code is available:

Http: // [www.2cto.com]/wp-admin/admin. php? Page = eshop-orders.php & view = 1 & action = % 22% 3E % 3 Cscript % 3 \
Ealert % 28document. cookie % 29; % 3C/script % 3E

3) Input passed via the "viewemail" GET parameter to/wp-admin/admin. php (when "page "\
Is set to "eshop-orders.php") is not properly sanitised before being returned to \
User. This can be exploited to execute arbitrary HTML and script code in \
Administrator's browser session in context of affected website.

Http: // [www.2cto.com]/wp-admin/admin. php? Page = eshop-orders.php & viewemail = % 22% 3E % 3 Cscript % 3 Eale \
Rt % 28document. cookie % 29; % 3C/script % 3E
Solution: Upgrade to the most recent version