Reflected XSS via unsanitized date parameter

Reflected cross-site scripting in Delete Old Orders through 0.2 allows remote attackers to execute script in an admin page via the date parameter. The plugin outputs the date parameter into an administrative page without sanitizing or escaping it, so a crafted request is reflected into HTML and script executes in a victim browser. Exploitation requires a remote attacker to induce an administrator or other logged-in user to open the crafted link; impact is limited to script execution in that browser context, with no evidence of server-side code execution.