Administrator browser script execution via reflected parameters

Reflected XSS in MageeWP Meris 1.1.2 and earlier allows remote attackers to execute scripts in an administrator's browser via crafted requests. The meris_widget_area_generator AJAX action returns the areaname and num POST parameters without sanitizing or escaping them, so script markup is inserted into its response. Exploitation requires a high-privilege user such as an administrator to submit the attacker-controlled form, after which the injected script runs in that user's session.