Cross site scripting

DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newlastname parameter...