VideoWhisper 7 Cross Site Scripting

`Vulnerability title: Cross-site scripting (XSS) vulnerability in Videowhisper  
CVE: CVE-2014-2715  
Vendor: VideoWhisper  
Product: Videowhisper module for Drupal 7  
Affected version: 7  
Fixed version:   
Reported by: Mahmoud Ghorbanzadeh  
  
Details:  
  
Hello,  
I found Cross-site scripting (XSS) vulnerability in the Videowhisper module for Drupal 7 (videowhisper-7.x). The vulnerability exist at line 2 and line 4 in drupal\modules\videowhisper\vwrooms\templates\logout.tpl.php due to $_GET['module'] and $_GET['message'] variables respectively at line 347 in drupal\modules\videowhisper\vwrooms\vwrooms.module.  
  
POC: drupal/index.php?q=vwrooms/logout&module=<script>alert('XSS1')</script>&message=<script>alert('XSS2')</script>  
  
Vendor Notification: 18, Apr 2014  
  
Discovered by Mahmoud Ghorbanzadeh, in Amirkabir University of Technology's Scientific Excellence and Research Centers.  
  
Best Regards.  
`