Wordpress Newsletter 3.2.6 Cross Site Scripting

`  
Wordpress Newsletter Plugin 3.2.6 (alert) Reflected XSS Vulnerability  
  
  
Vendor: Stefano Lissa  
Product web page: http://wordpress.org/extend/plugins/newsletter/  
Affected version: 3.2.6 and bellow  
  
Summary: Newsletter is the perfect WordPress plugin for creating  
real newsletters and mail marketing system on your WordPress blog.  
  
Desc: The plugin suffers from a XSS issue due to a failure to properly  
sanitize user-supplied input to the 'alert' GET parameter in the 'page.php'  
script. Attackers can exploit this weakness to execute arbitrary HTML  
and script code in a user's browser session.  
  
  
=======================================================================  
/subscription/page.php:  
-----------------------  
  
70: <?php if (!empty($alert)) { ?>  
71: <script>  
72: alert("<?php echo addslashes($alert); ?>");  
73: </script>  
74: <?php } ?>  
  
=======================================================================  
  
  
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)  
Apache 2.4.2 (Win32)  
PHP 5.4.7  
MySQL 5.5.25a  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2013-5141  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5141.php  
  
  
09.05.2013  
  
--  
  
http://10.0.55.5/wordpress/wp-content/plugins/newsletter/subscription/page.php?alert=</script><script>alert(/ZSL/);</script>  
`