Authenticated script execution via unescaped firstname output

Cross-site scripting in Wazifa System 1.0 allows remote authenticated users to run script in another user's browser via firstname. The Setting Handler's /controllers/updatesettings.php endpoint directly echoes the POSTed firstname value without filtering or output encoding. A valid account and a victim who loads the resulting response are required; successful exploitation changes browser-rendered content and runs attacker-supplied JavaScript in that user's session.