WordPress WPify Woo Czech <3.5.7 - Cross-Site Scripting Detection

WordPress WPify Woo Czech plugin before 3.5.7 contains a cross-site scripting vulnerability. The plugin uses the Vies library 2.2.0, which has a sample file outputting $SERVER'PHPSELF' in an attribute without being escaped first. The issue is only exploitable when the web server has the PDO drive...