PoC: Go to the demo website http://byluminary.com/envato_demos/Tasked/login.php and register your new account with payload inside «First Name» and/or «Last Name» fields (keep in mind that mail activation is enabled, to use any temp mail service for tests). Activate your account and log in using your credentials, then go to http://byluminary.com/envato_demos/Tasked/index.php?page=profile to launch your payload(s). More vulnerable fields: http://byluminary.com/envato_demos/Tasked/index.php?page=categories - create new category with desired payload inside «Name» and/or «Description» field(s); http://byluminary.com/envato_demos/Tasked/index.php?page=openTasks and http://byluminary.com/envato_demos/Tasked/index.php?page=calendar - same stuff like categories.