In admin/write-post.php in Typecho through 1.1 one can log in to the background page write a new article and add payload in the article content resulting in XSS via index.php/action/contents-post-edit.