Description
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively.
Remediation
References
Related Vulnerabilities
phpMyAdmin 7PK - Security Features Vulnerability (CVE-2016-6629)
WordPress Plugin User Access Manager Cross-Site Scripting (1.2.6.7)
WordPress Plugin Xhanch-My Twitter Multiple Cross-Site Request Forgery Vulnerabilities (2.7.7)
Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2011-4133)
Oracle Application Server Other Vulnerability (CVE-2002-0565)