The popular Dynamic Pricing and Discounts plugin from Envato ... Because some fields aren’t sanitized, the attacker can inject JavaScript code into the imported JSON-encoded file.” ...