Security concerns with "Share List" function

Thanks. I've modified lines 49 - 51 to the following in modules/mod_myshortlist/mod_myshortlist.php

$fromEmail = $app->getCfg('mailfrom');
$fromName = $app->getCfg('fromname');
$mailSender->setSender(array($fromEmail,$fromName));

Great! That's exactly what I did, too.
Please let me know when there's any additional information about the detected XSS vulnerability, so that I can release the pending update.

Thanks again!

I'm attaching screenshots of the MyShortList related vulnerabilities from the penetration test report we were given. 

Thank you very much.
Please allow me some time to check them thoroughly.
I will get back to you shortly.

Hi again. I confirm these issues. I'm working all day on this, and I have now fixed them all, so I just released a security update.
I have fixed these issues right in the heart of MyShortlist, so that these vulnerabilities are completely sealed for all users, regardless of their template overrides, as long as they immediately update to the latest version: 1.10.1434.

Let me explain what these issues are.
1. The first issue is related to adding items to the list.
Manually adding Javascript code (which is run by the browser in the client side) into the insertion form variables, results in this code being executed when the item is shown within the list.
For this issue to pose a true security risk, an attacker would have to already be logged-in as someone else. Otherwise, this code will only be executed in the attacker's computer or the attacker's user account.
It cannot affect any other users.

2. The second issue is related to creating new lists.
Again, an attacker can inject some Javascript code, that will be executed when a user adds or removes items from this list, using the Youtube-like dropdown button.
This issue also only affects the attacker's computer or attacker's user account, so they would require access to someone else's account, for this issue to pose a true risk.

HOWEVER.
I have found a third issue, based and related to the first issue, that poses a large vulnerability and CAN potentially execute Javascript code in the Joomla administrator.
As such, I urge all MyShortlist users to immediately update to version 1.10.1434 (or newer).

Thank you for your assistance in this.
Let me know if there's anything else I can do to help.