Edito CMS has a stored cross-site scripting (XSS) vulnerability in its Tiny editor functionality via the content parameter. An authenticated attacker can inject arbitrary HTML and JavaScript code that will execute when a user edits the affected content. This vulnerability was fixed in version 5.10.2607, with hotfixes also available for older 5.8 versions.