Google XML Sitemaps <= 4.0.8 - Authenticated Reflected XSS (via HOST header)

The plugin contains a Paypal donate button that is echoing the global variable HTTP_HOST, which can be manipulated by the visitor.

Vulnerable Code:

sitemap-ui.php L1310
echo 'http://' . $_SERVER['HTTP_HOST']...