Description

The blog author parameter is unsanitized on the page admin.php?p=config. In this way is possible to inject arbitrary javascript code

Proof of Concept

• Login as regular user
• Go to http://localhost/flatpress/admin.php?p=config
• Set as blog author "><script>alert(document.domain)</script>
• Refresh page