A stored cross-site scripting (XSS) vulnerability exists in Craft CMS control panel where an element's draft name is rendered without proper HTML encoding. A low-privilege user who can create drafts can inject JavaScript payloads into the draft name, which execute in the browsers of higher-privileged users viewing the draft's chip or card. This allows the attacker to execute arbitrary JavaScript in the victim's authenticated control panel session, potentially taking over the control panel by performing admin-only actions via the victim's session.