Multiple cross-site scripting (XSS) vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to inject arbitrary web script or HTML via the (1) sEcho parameter to comments_paginate.php or (2) stores_paginate.php or the (3) affiliate_url (4) description (5) domain (6) seodescription (7) seoheading (8) seotitle (9) seokeywords (10) settinglogo (11) settingperpage or (12) settingsitename to admin/index.php.