Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.
daybydaycrm daybyday 2.1.0