Cross site scripting

DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter...