Summary

A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized.
This allows executing arbitrary javascript code on the user's browser just by visiting the shop pages.

Impact

All logged in to fluxcp users can have their session info stolen.