WordPress Cart66 Lite 1.5.4 Cross Site Scripting

`Title: WordPress 'Cart66 Lite :: WordPress Ecommerce' plugin - Reflected XSS  
Version: 1.5.4  
Author: Morten Nørtoft, Kenneth Jepsen, Mikkel Vej  
Date: 2015/01/26  
Download: https://wordpress.org/plugins/cart66-lite/  
Contacted WordPress: 2015/01/26  
================================================================  
  
  
## Description:   
================================================================  
Cart66 is a simple to use yet powerful ecommerce plugin for WordPress. Sell digital products   
and/or physical products with Cart66. The easiest to use WordPress ecommerce shopping cart plugin.  
  
  
## Reflected XSS  
================================================================  
The plugin suffers from a reflected cross site scripting in the file orders.php  
which is loaded in /wp4/wp-admin/admin.php?page=cart66_admin by viewing the orders.  
The vulnerability can be exploited by tricking a logged in admin to click an URL  
  
  
## PoC  
================================================================  
The vulnerable parameter is called "status". The "status" parameter is retrieved from a $_GET['status'] call  
But is not further sanitized before printing the variable.   
  
The vulnerability can be exploited using the following link:  
  
/wp4/wp-admin/admin.php?page=cart66_admin&status=</script><script>alert(document.cookie);</script>  
  
## Solution  
================================================================  
Update to version 1.5.5.  
`