Craft CMS 4.x (>=4.0.0-RC1 <4.17.0-beta.1) and 5.x (>=5.0.0-RC1 <5.9.0-beta.1) have multiple stored cross-site scripting vulnerabilities due to improper neutralization of input during web page generation. Specifically, settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template using {{ label|raw }}), enabling an authenticated administrator with allowAdminChanges enabled to inject malicious JavaScript into various UI elements such as section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels. This results in arbitrary JavaScript execution in other users' control-panel sessions. The issues are resolved in versions 4.17.0-beta.1 and 5.9.0-beta.1.

An authenticated administrator with allowAdminChanges enabled can exploit these stored XSS vulnerabilities to execute arbitrary JavaScript code in other users' control-panel sessions. This could lead to session hijacking, unauthorized actions, or other impacts typical of XSS in administrative interfaces. The CVSS 4.0 score is 4.6 (medium severity), reflecting the need for authentication and user interaction, and limited scope and impact.

A fix is available in Craft CMS versions 4.17.0-beta.1 and later for the 4.x branch, and 5.9.0-beta.1 and later for the 5.x branch. Users should upgrade to these or later versions to remediate the vulnerability. No official patch or temporary workaround is indicated in the provided data. Until upgrading, restrict administrator access and consider disabling allowAdminChanges if feasible.