WordPress Video Player <= 1.5.4 - Reflected Cross-Site Scripting (XSS)

Description

The 'Tags' section of 'WordPress Video Player' under WordPress Administration contains a two fields that are vulnerable to a reflected XSS attack. This is due to the fact that the value passed through to these fields are not encoded prior to output. There is also no nonce on this page, which means the XSS can be triggered via CSRF.