An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page.