WordPress Gigya Socialize Plugin Cross-Site Scripting Vulnerabilities

MustLive has discovered some vulnerabilities in the Gigya Socialize plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks. Input appended to the URL after "[installation path]/" is not properly sanitised before before being returned to the user in wp-content/plugins/gigya-socialize-for-wordpress/views/widget/widget-not-connected.php and wp-content/plugins/gigya-socialize-for-wordpress/views/widget/widget-not-logged-in.php. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. The vulnerabilities are confirmed in version 1.1.8. Other versions may also be affected. http://site/?%22%3E%3Cscript%3Ealert(/XSS/)%3C/script%3E