Administrator session theft via stored script injection

Stored cross-site scripting in BytesForAll Atahualpa allows remote authenticated users to steal administrator sessions through crafted input. The disclosure says the theme stores malicious input supplied through a separate CSRF flaw, but the affected field and rendering code path are undisclosed. Exploitation requires administrator interaction with the CSRF lure and later rendering of the stored content; the resulting script can steal the administrator's session token or perform actions through that session.