The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site Scripting attacks.
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.00171·Published 2025-03-25·Fixed in 1.1.2CWE-352