Publically accessible pages that are using the shortcode ‘[gift_certificate_form]’ allow any user to add gift certificate entries into the database. These entries are listed by the Wordpress administrator when visiting the plugin admin page. This action is performed by gc-list.php which doesn't sanitize the entries before displaying them. This allows malicious javascript to be injected into the WordPress database. In file giftcertificates.php 141: if ($_REQUEST['action'] == 'Submit') { 144: //if (!empty($_REQUEST['cert_amount']) && !empty($_REQUEST['cc_number']) && !empty($_REQUEST['cc_sec_code'])) { 145: if (!empty($_REQUEST['cert_amount']) && !empty($_REQUEST['cc_sec_code'])) { 147: $gcmObj->createNewGCM($_REQUEST); 149: writeLog(" amount ".$_REQUEST['cert_amount']." and email ".$_REQUEST['cc_sec_code']." are posted successfully", basename(__LINE__), basename(__FILE__)); 152: $gcmObj->sendGCMReportEmail(GC_MAIL_TO, GC_MAIL_FROM, GC_MAIL_SUBJECT, $_REQUEST); 153: $_REQUEST = array(); 212- <form method="get" name="gc_form" action=""> 213- <table class='gc_form'> 214- <tr> 215- <th>Certificate Amount:</th> 216: <td><input type="text" name="cert_amount" value="<?php echo $_REQUEST['cert_amount']; ?>" placeholder ="$"></td> 217- </tr> 218- <tr> 219- <th>Your Name:</th> 220: <td><input type="text" name="user_name" value="<?php echo $_REQUEST['user_name']; ?>"> (optional)</td> 221- </tr> 222- <tr> 223- <th>Recipient Name:</th> 224: <td><input type="text" name="receip_name" value="<?php echo $_REQUEST['receip_name']; ?>"> (optional)</td> 225- </tr> 226- <tr> 227- <th>Recipient Email:</th> 228: <td><input type="text" name="cc_sec_code" value="<?php echo $_REQUEST['cc_sec_code']; ?>"></td> 229- </tr> 230- <tr> 231- <th>Recipient Address:</th> 232: <td><textarea name="receip_address" value="<?php echo $_REQUEST['receip_address']; ?>"></textarea> 233- </tr> 234- <tr> 235- <td colspan="2" style="text-align: center;"><input type="submit" value="Submit" name="action"></td> 236- </tr> 237- </table>