Etherpad versions before 3.3.0 contain a stored XSS vulnerability due to the getHTMLFromAtext function in src/node/utils/ExportHtml.ts. This function interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without proper HTML attribute escaping. An attacker can inject malicious values into the attribute pool via moveOpsToNewPool and AttributePool.putAttrib. When plugins like ep_font_color or ep_font_size register this hook, opening the exported HTML triggers the stored XSS in the Etherpad origin. The vulnerability is resolved in version 3.3.0.

An attacker with pad editor access can inject malicious script into exported HTML content, which executes in the context of the Etherpad origin when the export is viewed. This could lead to script execution affecting users who open the exported content. The CVSS 4.0 base score is 5.3 (medium severity), indicating a moderate risk with network attack vector, low complexity, no privileges or user interaction required, and limited scope and impact.

Upgrade Etherpad to version 3.3.0 or later, where this vulnerability is fixed. No other mitigation is indicated or required according to the available data.