Administrator-session script execution via unescaped beginfromid parameter

Reflected XSS in Ulf Benjaminsson Exhibit to WP Gallery 0.0.2 and earlier allows remote attackers to execute script via a crafted request. The plugin returns the beginfromid POST parameter in its WordPress settings page without sanitizing or escaping it, allowing injected script to run in the page. Exploitation requires a high-privilege user such as an administrator to open attacker-controlled HTML that submits the request, after which the script executes in that user's browser context.