Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.
typesettercms typesetter 5.1