Input validation vulnerability in Product Vendors 2.0.36

The Product Vendors plugin versions up to and including 2.0.35 are vulnerable to a type of attack called Reflected Cross-Site Scripting. This type of attack can be used by someone who has not been authenticated or authorized on the website to inject malicious web scripts into pages which will be executed if a user clicks on a link. This happens because the plugin does not sufficiently sanitize input and does not perform proper output escaping.