Livefyre LiveComments 3.0 Cross Site Scripting

`Title : Stored XSS in Livefyre LiveComments Plugin  
CVE : 2014-6420  
Vendor Homepage : http://livefyre.com  
Software Link : http://web.livefyre.com/streamhub/#liveComments  
Version : v3.0  
Author : Brij Kishore Mishra  
Date : 03-Sept-2014  
Tested On : Chrome 37, Ubuntu 14.04  
  
  
Description :  
  
This plugin requires user to be signed in via livefyre account to post  
comments. Users have the option to upload pictures in comments. This  
feature can be easily abused.  
  
Using an intercepting proxy (e.g. Burp Suite), the name variable can be  
edited to send an XSS payload while uploading a picture (payload used :  
"><img src=x onerror=prompt(1337)>). When the comment is posted, the image  
will be successfully uploaded, which leads to XSS due to an unsanitized  
field.  
`