There is a reflected xss flaw in the settings.action of dailysummary settings.action as the username parameter is not html encoded before being rendered on the page.
Here is an example of a reflected xss (it adds a picture of a lolcat to the page).

https://wpad.jira-dev.com/wiki/plugins/dailysummary/settings.action?setting=subscribe-to-recommended&value=false&token=&username=%22'x%3Cimg%20src=http://mintyferret.com/wp-content/uploads/2007/07/lolcat7.gif%3E