CVE-2017-20060: Cross site scripting in Elefant CMS

The vulnerability stems from unescaped output of user-controlled data (blog post titles/tags) in the Blog Post Handler. The Full Disclosure PoC explicitly shows that malicious titles/tags are stored and rendered in multiple contexts (e.g., <title>, <h1>, href attributes). Functions handling persistence (save()) and rendering (render()) are the most likely candidates. While exact code isn't available, Elefant's MVC structure and the component's description strongly suggest these functions are involved in the insecure handling of user input.