When you create a new dashboard tab the title is not HTML escaped.
1) Login 2) Click on "Config" 3) Click on "Add new Tab" 3) Name it <img src=x onerror=alert(0)> 4) Save XSS Payload will be executed
Please, read forum first: https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830
You must rebuilding theme, access its in admin tools
