WordPress statspressCN 1.9.0 Stored Cross Site Scripting

`# Exploit Title: Wordpress statspressCN search Keywords stored XSS  
# Date: 21-1-2010  
# Author: Saif El-Sherei  
# Software Link: http://downloads.wordpress.org/plugin/statpresscn.1.9.0.zip  
# Version: wordpress(3.0.4), StatsCN(1.9.0)  
# Tested on: Firefox 3.0.15, , IE 8  
  
  
Info:  
  
This plugin shows you real time statistics about your blog, track your  
friends's visit, provide function such as post's hotness, hottest post,  
related post, visitor's list at current time, also support for Chinese  
perfectly. It collects information about visitors, spiders, search keywords,  
feeds, browsers, OS etc. If own a wordpress blog, you can use it freely,  
nothing else needed. Having fun!  
  
POC:  
  
<script>alert(1);</script>  
<script>alert('AAAAAAAAAAAAAA');</script>  
  
Details:  
  
Due to size limitation for search keyword in StatsCN dashboard; You can only  
cause a defacment to it & the script wont run; but in the spy section, there  
is no size limitation so an attacker can use any XSS attack he wants you can  
use the 2nd POC for that.  
  
  
Regards,  
  
Saif El-Sherei  
  
OSCP  
`