Cross Script Vulnerabilities

Sitelock has informed me that there are some cross script vulnerabilites attached to some of the Add to Cart buttons on this site http://www.luckystarsdance.com/classes/spring-class-schedule/.

Here is one example of sitelock report…
URL:http://www.luckystarsdance.com/classes/spring-class-schedule/?%3D1%26Add to Cart%3DAdd to
Cart%26Add%20to%20Cart%3DAdd%20to%20Cart%26addcart%3D1%26cartLink%3Dhttp:/www.luckystarsdance.com/classes/spring-class-schedule/%2
6price%3D120%26product%3DWest%20Coast%20Swing%20Int/Adv%26product_tmp%3DWest%20Coast%20Swing%20Int/Adv%26quantity%3D1
Cross site scripting vulnerability found in args:,Add%20to%20Cart,addcart,cartLink,price,product,product_tmp,quantity

Has anyone else experienced this and know how to fix?

What is weird is that it is only reporting the vulnerability with a few of the buttons.

http://wordpress.org/extend/plugins/wp-ultra-simple-paypal-shopping-cart/