Some vulnerabilities have been reported in the Backend Localization plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "kau-boys_backend_localization_language" parameter to e.g. wp-admin/options-general.php (when "page" is set to "kau-boys-backend-localization/backend_localization.php") or wp-login.php is not properly sanitised in kau-boys-backend-localization/backend_localization.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in versions prior to 2.0.

Solution
Upgrade to version 2.0.

Provided and/or discovered by
The vendor credits Matt Fuller.

Original Advisory
http://wordpress.org/extend/plugins/kau-boys-backend-localization/changelog/
http://plugins.trac.wordpress.org/changeset/579507/kau-boys-backend-localization

Deep Links
Links available to Secunia VIM customers