A vulnerability has been discovered in the TheCartPress plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to e.g. the "tcp_name_post_1" parameter in admin/OptionsPostsList.php (when "tcp_options_posts_update" is set and "tcp_post_ids[]" is set to "1") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is confirmed in version 1.1.5 and reported in version 1.1.6 downloaded prior to 2011-12-31. Prior versions may also be affected.

Solution
Update to version 1.1.6 released after 2011-12-31.

Provided and/or discovered by
6Scan

Changelog
Further details available to Secunia VIM customers

Original Advisory
WordPress TheCartPress Plugin:
http://plugins.trac.wordpress.org/changeset/482746/thecartpress

6Scan:
http://packetstormsecurity.org/files/108272/wpcartpress-xss.txt

Deep Links
Links available to Secunia VIM customers