MISP versions before 2.5.37 contain a stored cross-site scripting (XSS) vulnerability in the template element attribute handling logic. The vulnerability arises because the application accepts arbitrary values for TemplateElementAttribute type and category fields without validating them against known definitions. This flaw allows an attacker with permission to create or modify template element attributes to store crafted type values that can lead to XSS. The affected old templating engine is not accessible starting from version 2.5.37 and will be removed in version 2.5.38.