EIP-2026-109548

This is a functional proof-of-concept for a stored XSS vulnerability in MODx Revolution CMS 2.0.4-pl2. It demonstrates how arbitrary JavaScript can be executed via the 'username' and 'email' parameters in the login.php script due to insufficient input sanitization.