Monstra is fast and small content management system written in PHP! It's free, open source and easy to use from the start!
Monstra suffers from multiple stored XSS vulnerabilities when parsing user input to the 'menu_item_link', 'menu_item_name' and 'page_title' parameters via POST method thru 'index.php' script. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, and influence or misrepresent how Web content is served, cached, or interpreted.