Craft CMS 4.x (>=4.0.0-RC1 <4.17.0-beta.1) and 5.x (>=5.0.0-RC1 <5.9.0-beta.1) have multiple stored XSS vulnerabilities due to unsanitized rendering of settings names and field option labels, such as in the checkbox.twig template using {{ label|raw }}. An authenticated administrator with allowAdminChanges enabled can inject malicious JavaScript into various UI elements (section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels). This results in arbitrary JavaScript execution in other users' control-panel sessions. The vulnerabilities are fixed starting from versions 4.17.0-beta.1 and 5.9.0-beta.1.

An authenticated administrator with allowAdminChanges enabled can inject malicious JavaScript payloads into multiple UI elements, leading to stored cross-site scripting that executes in other users' control-panel sessions. This can compromise the confidentiality and integrity of user sessions and potentially allow unauthorized actions within the control panel. The CVSS score is 4.8 (medium severity), reflecting limited impact due to required privileges and user interaction.

Upgrade Craft CMS to version 4.17.0-beta.1 or later for the 4.x branch, or to version 5.9.0-beta.1 or later for the 5.x branch, where the stored XSS vulnerabilities have been fixed. No other mitigations are indicated by the advisory.