#Affected Vendor: http://modx.com/
#Date: 08/05/2015
#Creditee: http://osvdb.org/creditees/13518-vadodil-joel-varghese
#Type of vulnerability: Multiple Cross Site Scripting Vulnerability
#Tested on: Windows 8.1
#Product: MODX Revolution
#Version: 2.3.3-pl

"Content" field in create new resources (
http://localhost/modx/manager/?a=resource/create), "lexicon key" and
"Description" field in create menu (
http://localhost/modx/manager/?a=system/action), "Name" and "Description"
field in create dashboard (
http://localhost/modx/manager/?a=system/dashboards/create)

The above mentioned fields were found to be vulnerable to Stored XSS. The
PoC used is "><img src="blah.jpg" onerror="alert('XSS')"/>.

Notified Vendor: 08/05/2015
No response received for the vendor
Public Disclosure: 29/06/2015

-- 
Regards,

*Joel V*