See how djangoblog compares to other vendors in security performance
DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the classfilter comment sanitizer passes event-handler attributes on span, div, pre and code tags. Authenticated commenters can post a div with autofocus and onfocus attributes, executing script without interaction for every visitor, including administrators.
Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master.