Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.

Source