Cross Site Scripting in Custom Pagers

Hi,

function custom_pagers_page() doesn't run the node type name through check_plain():

$row[] = !empty($pager->visibility_php) ? t('PHP snippet') : $pager->node_type . t(' nodes');

Saving a node type with a name of

alert(document.cookie)

, then saving a custom pager for that node type, gives you your cookie when you view the custom pagers overview. It looks like custom_pagers doesn't update node type names when a node type is saved, so the either someone would need to have permissions for both administer nodes and administer custom pagers, or an admin would have to choose a node type with

tags for their pager. 6.x version is in beta, it's the same in 5.9. Please note: This vulnerability requires "adminsiter content types" permission, therefore Drupal Security Team has agreed on creating a public issue in the module queue.